ProxyToken Exchange Server Vulnerability
ProxyToken is an authentication bypass vulnerability affecting modern versions of Microsoft Exchange Server. Exploitation of ProxyToken could allow an attacker to access users mail, or create forwarding rules to any Internet destination.
Summary
ProxyToken is an authentication bypass vulnerability affecting modern versions of Microsoft Exchange Server. Exploitation of ProxyToken could allow an attacker to access users mail, or create forwarding rules to any Internet destination.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Security researchers have disclosed details of an information disclosure vulnerability, called ProxyToken, affecting Microsoft's Exchange Server mail server. They claim that an unauthenticated attacker could exploit this vulnerability to edit configuration settings for any user on an affected Exchange Server instance.
Vulnerability details
ProxyToken appears to be the result of authentication failure between Exchange Server's front- and back-end. By default, Exchange creates two Internet Information Services (IIS) sites: a front-end that handles authentication for all clients and proxies their requests, and a back-end that handles all these requests and responds to the front-end.
In instances where Exchange Server uses Delegated Authentication, the front-end is unable to authenticate requests and instead hands them to the back-end to perform authentication.
Delegated Authentication
Delegate Authentication is an Exchange feature that allows it to support cross-forest Active Directory topologies, including Forest Trusts. Exchange Server instances must be configured with DelegatedAuthModule in order for Delegated Authentication to function.
Impact
If the Exchange Server back-end does not have DelegatedAuthModule loaded, then any request with the SecurityToken cookie will be processed without authentication. However, any request to the back-end requires an "ECP canary" ticket, without which it will return an internal server error (HTTP 500). Unfortunately, this error response includes a valid "ECP canary" which can then be reused for any future requests.
By specially crafting requests, an attacker is able to bypass authentication and access a vulnerable Exchange Server, at which point they are able to access all connected clients' incoming mail and create auto-forwarding rules. If the Exchange Server instance permits arbitrary destinations, then mail can be forwarded to any Internet location.
Remediation advice
Microsoft addressed ProxyToken in July 2021 as part of their regular update schedule. Affected organisations are encouraged to review Microsoft Security Update Guide CVE-2021-33766 and Knowledge Base article KB5001779 and apply any relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 1 September 2021 12:23 pm