Microsoft · Exchange Server
Microsoft Exchange Server contains a security feature bypass vulnerability, classified under unrestricted upload of files with dangerous types and improper input validation. An attacker with network access and high-privilege authentication, and with no user interaction required, can exploit this flaw to bypass security controls and achieve high impact to confidentiality, integrity and availability, with high attack complexity.
First seen exploited 4 months after disclosure. Public exploit code (Metasploit) was available 35 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-31207 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.
2 passages name itOriginal (opens in a new tab) ↗
ELBRUS has also been abusing CVE-2021-31207 in Exchange to compromise organizations in April of 2022, an interesting pivot to using a less popular authenticated vulnerability in the ProxyShell cluster of vulnerabilities.
Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.
2 passages name itOriginal (opens in a new tab) ↗
In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.
Hive actors gain access to victim network by exploiting the following Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-42321.
2 passages name itOriginal (opens in a new tab) ↗
Mentions the CVE; no further detail.
Mentions the CVE; no further detail.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.