9.1 CVE-2021-26855
CISA Kev Catalog Used by Malware Used by Ransomware Patch Exploit
Microsoft Exchange Server Remote Code Execution Vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2021-26855
Categories
CWE-918 : Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Cross Site Port Attack Server-Side Request Forgery Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Chain: LLM integration framework has prompt injection(CWE-1427) that allows an attacker to force the service to retrievedata from an arbitrary URL, essentially providing SSRF (CWE-918) andpotentially injecting content into downstream tasks. Server Side Request Forgery (SSRF) in mail server, as exploited in the wild per CISA KEV. Server Side Request Forgery in cloud platform, as exploited in the wild per CISA KEV. Chain: incorrect validation of intended decimal-based IP address format (CWE-1286) enables parsing of octal or hexadecimal formats (CWE-1389), allowing bypass of an SSRF protection mechanism (CWE-918). Web server allows attackers to request a URL from another server, including other ports, which allows proxied scanning. CGI script accepts and retrieves incoming URLs. Web-based mail program allows internal network scanning using a modified POP3 port number. URL-downloading library automatically follows redirects to file:// and scp:// URLs
References
af854a3a-2127-422b-91ae-364da2661108 Patch Exploit
| http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbi... Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Rem... Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthent... Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Col... Exploit Third Party Advisory VDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-2... Patch Vendor Advisory |
secure@microsoft.com Patch Exploit
| http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbi... Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Rem... Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthent... Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Col... Exploit Third Party Advisory VDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-2... Patch Vendor Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:* | ||
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:* | ||
REMEDIATION
Patch
| Url |
|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-2... |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-2... |
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
Other Nist (github, ...)
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 664 | Server Side Request Forgery |
High |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
