CVE-2021-26855

CVE-2021-26855 is a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange servers, particularly versions 2013, 2016, and 2019. This flaw in software design or implementation was exploited by attackers to gain initial access to the email servers and drop an ASPX webshell on the compromised systems. The exploitation of this vulnerability enabled threat actors to execute client-side attacks (T1203), exploit public-facing applications (T1190), and disseminate phishing emails through hijacked email threads obtained from Microsoft ProxyLogon attacks. On December 2, 2022, a significant ransomware attack disrupted email services for thousands of small and medium-sized businesses (SMBs) due to the unpatched ProxyLogOn zero-day vulnerability (CVE-2021-26855). The update had not been applied due to operational concerns. The cybercriminals leveraged the vulnerability to infiltrate the email servers, leading to substantial disruption and data compromise. The incident was investigated by GERT, who confirmed SMB abuse, IKEEXT service exploitation, and the exploitation of the Microsoft Exchange server remote code execution vulnerability. In addition to these disruptions, attackers deployed a novel backdoor called 'Sponsor' onto target systems after obtaining initial access via the known vulnerabilities in the internet-exposed Microsoft Exchange servers. This operation further complicated the security landscape and amplified the potential damage caused by the CVE-2021-26855 vulnerability. In conclusion, the CVE-2021-26855 vulnerability represents a significant risk to organizations using affected versions of Microsoft Exchange servers, highlighting the importance of timely patching and robust cybersecurity measures.