PoC Exploit Published for Latest Microsoft Exchange Zero-Day


A certainty researcher has released proof-of-concept (PoC) exploit code for a recently patched code execution vulnerability affecting on-prem Microsoft Exchange Server consecrations.

Tracked as CVE-2021-42321 (CVSS 8.8), the security defect was addressed with the November 2021 Patch Tuesday set of updates, when Microsoft alerted that it was already being exploited in “limited targeted attacks in the wild.”

Affecting on-premises Microsoft Exchange Server, including Exchange Cross-breed mode instances, the bug is described as a post-authentication flaw that affects Exchange 2016 and 2019.

An authenticated attacker, Microsoft said, could exploit the confidence hole to execute code remotely on vulnerable systems.

Less than two weeks after the Redmond-based tech giant detailed the flaw, a insurance researcher going by the online handle of Janggggg announced the release of PoC exploit code targeting the vulnerability.

The code was designed to launch mspaint.exe on the end system and an be used “to recognize the signature pattern of a successful attack event,” the researcherr said.

On November 9, Microsoft encouraged administrators to invest the newly released patches immediately, to prevent exploitation and the release of the PoC code should be a wakeup call for all those who use a vulnerable Exchange Server deviating and haven’t applied the update yet.

Related: Zero-Days Under Attack: Microsoft Plugs Exchange Server, Excel Holes

Related: Researchers Unchain PoC Tool Targeting BrakTooth Bluetooth Vulnerabilities

Related: PoC Exploit Released for macOS Gatekeeper Bypass

[embedded content]

PoC Exploit Published for Latest Microsoft Exchange Zero-Day

Ionut Arghire is an supranational correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:
PoC Exploit Published for Latest Microsoft Exchange Zero-DayTags:

Leave a Reply

Your email address will not be published. Required fields are marked *