Microsoft Exchange - Reflected Cross-Site Scripting (ProxyOracle - CVE-2021-31195) (CVE-2021-31195)

Microsoft Exchange server is affected by a Cross-Site Scripting (XSS) attack which can be performed at the /owa/auth/frowny.aspx endpoint. The root cause of this vulnerability is the lack of input validation in the Client Access Service (CAS) Frontend. An attacker can exploit this vulnerability to inject malicious JavaScript code in the URI.

The risk exists that a remote unauthenticated attacker could exploit this vulnerability and send malicious URLs to the Exchange clients which can then steal their unencrypted usernames and passwords if accessed.

Applying the latest Microsoft patch for the Exchange Server will fix this vulnerability.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195