Microsoft Exchange ProxyShell Exploitation
In May 2021, Microsoft released a patch for vulnerabilities that are being used by multiple advanced persistent threat groups. A remote attacker could exploit these vulnerabilities to take control of an affected system.
Summary
In May 2021, Microsoft released a patch for vulnerabilities that are being used by multiple advanced persistent threat groups. A remote attacker could exploit these vulnerabilities to take control of an affected system.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
ProxyShell is a string of three vulnerabilities that could enable an unauthenticated attacker to perform remote code execution, elevation of privilege, and a security feature bypass vulnerability.
Active Exploitation
ProxyShell is being exploited in the wild by attackers that could execute arbitrary code and take control of a system.
Remediation advice
Affected organisations are encouraged to review Microsoft’s advisories for the following CVEs: CVE-2021-31207, CVE-2021-34473, and CVE-2021-34523 and apply the necessary updates or workarounds.
Alternatively, please ensure that the affected versions of Microsoft Exchange have been remediated by the application of the May 2021 security update or the July 2021 security update.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 27 August 2021 11:10 am