Post-authentication arbitrary file write in Microsoft Exchange Server

Successful exploitation permits unauthorized file creation at arbitrary server locations and can lead to remote code execution through deployed webshells. Subsequent compromise can enable persistent remote access, mailbox and server-data theft, credential harvesting, additional malware installation, and lateral movement. Observed campaigns using this vulnerability alongside related Exchange flaws deployed China Chopper webshells, cryptomining malware, and ransomware.

Temporarily disconnect unpatched internet-facing Exchange servers or restrict untrusted HTTPS connections and place external access behind a VPN. Microsoft's interim Exchange mitigations included an IIS rewrite rule and disabling selected Exchange services or virtual directories, but could affect functionality and did not cover every exploitation method. Use Exchange-log analysis, malware scanning, and endpoint monitoring to identify existing compromise. Perimeter restrictions do not stop attackers who already have internal access, and temporary mitigations are not substitutes for security updates.

Apply Microsoft's Exchange security updates addressing CVE-2021-26858, initially released on March 2, 2021. The original update prerequisites were Exchange Server 2013 CU23, Exchange Server 2016 CU18 or CU19, and Exchange Server 2019 CU7 or CU8; older installations require an appropriate cumulative update before the security update. Install updates with administrator privileges and verify successful installation. Investigate potentially exposed servers for historical compromise. If compromise is detected, isolate affected systems, preserve forensic evidence, remove attacker-controlled accounts, webshells and persistence mechanisms, and reset compromised credentials. Patching alone does not remove an existing intrusion.