CVE-2021-26855: Microsoft Exchange Server RCE Vulnerability

CVE-2021-26855 Overview

CVE-2021-26855 is a critical Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server, commonly known as "ProxyLogon." This vulnerability allows unauthenticated remote attackers to send arbitrary HTTP requests and authenticate as the Exchange server, enabling access to internal backend services that would otherwise be inaccessible from the internet. When chained with other vulnerabilities in the ProxyLogon attack chain, this SSRF flaw enables complete server compromise, including arbitrary code execution and full access to email communications.

Critical Impact

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can leverage this flaw to gain initial access, exfiltrate sensitive email data, deploy webshells, and establish persistent backdoor access to compromised Exchange environments without any authentication.

Affected Products

• Microsoft Exchange Server 2013 (Cumulative Updates 21-23)
• Microsoft Exchange Server 2016 (Cumulative Updates 8-19)
• Microsoft Exchange Server 2019 (RTM through Cumulative Update 8)

Discovery Timeline

• 2021-03-03 - CVE-2021-26855 published to NVD
• 2025-12-18 - Last updated in NVD database

Technical Details for CVE-2021-26855

Vulnerability Analysis

CVE-2021-26855 exploits a flaw in the Microsoft Exchange Server's Client Access Service (CAS) component, which handles incoming client connections and proxies requests to backend services. The vulnerability exists in how Exchange handles HTTP request routing, specifically in the ProxyRequestHandler class that processes incoming HTTPS requests.

The SSRF vulnerability allows an attacker to craft malicious HTTP requests that bypass authentication checks and are forwarded directly to internal backend Exchange services. By manipulating request headers and the target URL, attackers can impersonate the Exchange server itself when communicating with backend components. This is particularly dangerous because internal services often trust requests originating from the frontend proxy without additional authentication verification.

When exploited successfully, this vulnerability grants attackers the ability to read arbitrary email mailboxes, access the Exchange Control Panel (ECP), and when combined with CVE-2021-27065, write arbitrary files to the server—enabling webshell deployment and remote code execution.

Root Cause

The root cause of CVE-2021-26855 is improper validation of incoming HTTP request data before proxying requests to backend services. The Exchange frontend service fails to adequately verify that the target of proxy requests is a legitimate backend service, allowing attackers to specify arbitrary internal URLs. Additionally, the authentication mechanism does not properly validate that the request originates from a trusted source before granting access to sensitive backend functionality.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), where the application can be tricked into making requests to unintended locations on behalf of the attacker.

Attack Vector

The attack is executed remotely over the network without requiring any authentication or user interaction. Attackers target internet-facing Exchange servers on port 443 (HTTPS), leveraging the Outlook Web Access (OWA) and Exchange Control Panel (ECP) endpoints.

A typical exploitation flow involves:

1. An attacker sends a specially crafted HTTP POST request to the Exchange server's /ecp/ endpoint
2. The request includes manipulated cookies and headers that exploit the SSRF vulnerability
3. The Exchange frontend incorrectly proxies the request to internal backend services
4. The attacker receives responses from internal services, potentially including authentication tokens
5. These tokens can then be used to access mailboxes, write files, or execute additional exploitation steps

The attack has been widely observed in mass exploitation campaigns, with threat actors deploying webshells such as aspx files in publicly accessible directories to maintain persistent access. For detailed technical analysis of the exploitation mechanism, refer to the Microsoft Security Advisory and the Packet Storm RCE Exploit documentation.

Detection Methods for CVE-2021-26855

Indicators of Compromise

• Presence of suspicious ASPX webshell files in Exchange directories such as C:\inetpub\wwwroot\aspnet_client\ or C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
• Unusual POST requests to /ecp/ and /owa/ endpoints from external IP addresses with anomalous X-BEResource cookie values
• W3WP.exe process spawning unexpected child processes such as cmd.exe, powershell.exe, or mshta.exe
• Suspicious entries in Exchange HttpProxy logs showing SSRF patterns targeting internal backend URLs
• Unexpected .aspx files with recent modification timestamps in web-accessible directories

Detection Strategies

• Implement IIS log analysis to identify requests containing the X-AnonResource-Backend cookie or unusual X-BEResource values targeting internal services
• Monitor for file creation events in Exchange web directories, particularly new .aspx files that could indicate webshell deployment
• Deploy network detection rules for suspicious HTTP POST requests to Exchange ECP endpoints with abnormal header combinations
• Utilize Microsoft's published detection scripts and the Exchange On-premises Mitigation Tool (EOMT) to scan for indicators of compromise

Monitoring Recommendations

• Enable and centralize logging for IIS, Exchange HttpProxy, and Windows Security events on all Exchange servers
• Configure alerts for process creation events where w3wp.exe spawns command interpreters or scripting engines
• Implement file integrity monitoring on Exchange web directories to detect unauthorized file modifications
• Monitor outbound network connections from Exchange servers for unusual destinations or data exfiltration patterns
• Review Exchange administrative actions and mailbox access logs for unauthorized access patterns

How to Mitigate CVE-2021-26855

Immediate Actions Required

• Apply Microsoft's security updates immediately—this vulnerability has been actively exploited since at least January 2021
• Scan Exchange servers using Microsoft's published detection scripts and the Test-ProxyLogon.ps1 script to identify potential compromise
• If compromise indicators are found, isolate the server, preserve forensic evidence, and initiate incident response procedures
• Review and restrict external access to Exchange servers, considering placement behind a VPN or implementing IP allowlisting where feasible
• Reset credentials for any accounts that may have been accessed through compromised Exchange servers

Patch Information

Microsoft released security updates addressing CVE-2021-26855 on March 2, 2021. Organizations should install the appropriate cumulative update or security patch for their Exchange Server version. Detailed patch information is available in the Microsoft Security Advisory for CVE-2021-26855.

For Exchange Server 2013, 2016, and 2019, Microsoft provides both full cumulative updates and targeted security updates. Organizations should verify their current cumulative update level and apply the corresponding security patch.

Workarounds

• Implement URL Rewrite rules to block known malicious request patterns targeting the /ecp/ virtual directory as an interim measure if immediate patching is not possible
• Restrict external access to Exchange services by deploying the server behind a reverse proxy with strict access controls
• Disable external-facing OWA and ECP endpoints temporarily while preparing for emergency patching
• Use Microsoft's Exchange On-premises Mitigation Tool (EOMT) which applies IIS URL Rewrite rules to mitigate the vulnerability

# Microsoft's recommended URL Rewrite rule to mitigate CVE-2021-26855
# Apply this to the "Autodiscover" frontend site in IIS
# Block requests with malicious X-AnonResource-Backend or X-BEResource cookies

New-WebConfigurationProperty `
    -Filter "system.webServer/rewrite/rules" `
    -Name "." `
    -Value @{
        name = 'X-AnonResource-Backend-CVE-2021-26855'
        patternSyntax = 'Regular Expressions'
        stopProcessing = 'True'
    } `
    -Location "Default Web Site/Autodiscover"