NCSC-TAD-2108-003
Severity Level: Critical
Vulnerability
Reference No.: NCSC-TAD-2108-003CVSS 0
ProxyShell Affecting Microsoft Exchange Servers
- Threat Type:
- N/A
- TLP:
- CLEAR
- CVE:
- CVE-2021-34473, CVE-2021-34523, CVE-2021-31207
Overview
Threat actors are exploiting three chained vulnerabilities, CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207, collectively known as ProxyShell, to attack Microsoft Exchange Servers. The attack allows unauthenticated remote code execution. The attackers deploy web shells and use “createhidetask.exe” to create a scheduled task named “PowerManger”, which runs “ApplicationUpdate.exe” as a backdoor at 1 AM every day.
Affected Technologies
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
Mitigation and Immediate Actions
- 01
Patch CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 on the affected products by installing the latest patches released by Microsoft.
References
- Exchange Servers Under Active Attack via ProxyShell Bugs. (2021). Retrieved from Threat Post:(opens in a new tab)
- Microsoft Exchange servers are getting hacked via ProxyShell exploits. (2021). Retrieved from Bleeping Computer(opens in a new tab)
- ProxyShell: Attackers Actively Scanning for Vulnerable Microsoft Exchange Servers (CVE-2021-34473). (2021). Retrieved from Tenable(opens in a new tab)