Home Platform updates Detect Microsoft Exchange RCE #proxynotfound with our Network Vulnerability Scanner

Detect Microsoft Exchange RCE #proxynotfound with our Network Vulnerability Scanner

by Andra Zaharia

Reading time

2 minutes

Reading Time: 2 minutes

Running on-prem Microsoft Exchange servers?

If you didn’t catch the NSA boilerplate announcement, there’s another batch of vulnerabilities to scan for – and we built what you need.

We just added a new detection module to our Network Vulnerability Scanner. It checks if your Exchange servers are vulnerable to the attack chain that exploits four recent CVEs and results in Remote Code Execution.

Ours is the second scanning tool of its kind in the world that can identify vulnerable servers remotely. That means you can probe systems by connecting to the target through the network, without local access or credentials.

Here’s why we built it.

No advisory? No PoC? No problem!

Since these CVEs were published (April 13, 2021), we’ve been looking for a detailed technical advisory – but it never came. No solid PoC exploit scripts surfaced either, so we took matters into our own hands.

Our team built a detection module that identifies Exchange servers vulnerable to the combination of pre-auth and post-auth vulnerabilities the NSA disclosed:

Bad actors love these because the first two vulns don’t even require authenticating to the exposed Exchange Server. All they have to do is to do thorough recon and send specially crafted requests to their target to get RCE.  

If you’ve already dealt with ProxyLogon (for which we launched a dedicated scanner in March), know these security weaknesses have a similar operation model.

Get proactive

Find exposed servers

Patched or not? Detect the #proxynotfound attack chain

A malicious actor can only exploit the last two CVEs in this batch if they authenticate to the vulnerable Exchange Server. But, by chaining two of these flaws, they can skip that step altogether.

In April, we saw attackers use the same approach when they combined ProxyLogon with post-auth vulns to embed webshells and achieve persistence on unpatched Exchange servers. While this is not a replica of the ProxyLogon situation, we can use that cautionary tale to guide remediation efforts.

Once you know which servers need patching, you can deploy the cumulative update Microsoft released for these issues.

microsoft cumulative update proxynotfound

Get ahead of the curve & find exposed Exchange servers


Related Posts

Pentest-tools.com platform updates April 2022

April updates: Get RCE evidence for 6 critical CVEs

Pentest-Tools.com product updates March 2022

March updates: Spring4Shell: find and confirm exploitable targets and more updates



Subscribe to our Platform Updates

Please select how you would like to hear from Pentest-Tools.com:

Unsubscribe any time by clicking the link in the footer of our emails.
For information about our privacy practices, please visit https://pentest-tools.com/.

We use Mailchimp as our marketing platform. By clicking below to subscribe, you acknowledge that your information will be transferred to Mailchimp for processing.
Learn more about Mailchimp's privacy practices here.

View previous campaigns.