CVE-2021-31207

CVE-2021-31207 is a significant software vulnerability that has been exploited by APT40, a group known for rapidly taking advantage of newly public vulnerabilities in widely used software. This particular vulnerability affects Atlassian Confluence and Microsoft Exchange, among other platforms, and allows the attacker to bypass security features and execute remote code. The threat posed by this flaw is severe due to its potential use in initial stages of sophisticated attacks, such as those deploying BlackCat ransomware. APT40 has been successful in exploiting vulnerabilities dating back to 2017, demonstrating their ability to leverage older flaws alongside newer ones like CVE-2021-31207. Their tactics often involve spearphishing attacks to establish initial access, followed by exploitation of lax security practices leaving known vulnerabilities unpatched. For instance, they have previously exploited a seven-year-old privilege-escalation vulnerability affecting older versions of Microsoft Windows (CVE-2016-0099), and the two-year-old ProxyShell vulnerabilities (including CVE-2021-31207, CVE-2021-34473, CVE-2021-34523) affecting Microsoft Exchange. Check Point IPS provides protection against these threats, including the Microsoft Exchange Server Security Feature Authentication Bypass (CVE-2021-31207) and the Microsoft Exchange Server Remote Code Execution (CVE-2021-34473). Therefore, it is essential for organizations to keep their software up-to-date and apply patches for identified vulnerabilities promptly. By doing so, they can significantly reduce the risk of falling victim to attacks leveraging these vulnerabilities.