CVE-2021-26855

CVE-2021-26855 is a significant software vulnerability, specifically a zero-day server-side request forgery (SSRF) flaw, found in Microsoft Exchange 2013, 2016, and 2019. This vulnerability was exploited by attackers to gain initial access to email servers and drop an ASPX webshell, leveraging the technique T1190: Exploit Public-Facing Application. The threat actors were able to disseminate phishing emails through hijacked email threads, potentially obtained from Microsoft ProxyLogon attacks. On December 2, 2022, this vulnerability led to a disruptive ransomware attack that impacted thousands of SMB customers' email services. The culprit was the unpatched ProxyLogon zero-day vulnerability (CVE-2021-26855), which had not been addressed due to operational concerns related to the update. This attack underlines the severity of the vulnerability and the potential consequences of failing to promptly patch known issues. In addition to the ransomware attack, attackers were also observed deploying a novel backdoor called 'Sponsor' onto target systems after gaining initial access via the CVE-2021-26855 vulnerability in internet-exposed Microsoft Exchange servers. This vulnerability forms part of a pre-authentication remote code execution (RCE) chain (including CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) that allows an attacker to take over any reachable Exchange server without needing valid account credentials. These incidents highlight the critical need for timely security updates to address such vulnerabilities.