Very High
CVE-2021-34523
CVE-2021-34523
Add Assessment
Technical Analysis
CVE-2021-34523 is a privilege escalation vulnerability in Microsoft Exchange Server that arises due to improper validation of PowerShell remoting requests. This vulnerability enables an attacker to elevate their privileges within the Exchange server environment.
Affected Versions
The vulnerability affects the following versions of Exchange Server:
Microsoft Exchange Server 2013 Microsoft Exchange Server 2016 Microsoft Exchange Server 2019
Root Cause
The issue stems from insufficient authentication and access controls in the Exchange PowerShell backend interface. Specifically, the Exchange PowerShell service fails to properly validate caller identities and privileges, which can be exploited to execute commands with elevated permissions.
Exploitation
An attacker with authenticated access to the Exchange server (e.g., as a low-privilege user) can exploit this vulnerability by:
Crafting Malicious PowerShell Requests: Sending specially crafted requests to the Exchange PowerShell endpoint. Escalating Privileges: Abusing the vulnerability to gain higher-level privileges, such as those of a Domain Admin or SYSTEM account. Remote Code Execution (Chained Exploitation): Combining this vulnerability with others (e.g., CVE-2021-34473) can lead to full remote compromise.
CISA released an updated advisory on the BianLian ransomware group including the vulnerabilities the group is using to gain initial access towards victims.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- exchange server 2013,
- exchange server 2016,
- exchange server 2019
Metasploit Modules
Exploited in the Wild
References
