Pre-Authentication SSRF in Exchange Leads to Remote Code Execution
Unpatched Exchange servers are fully compromised by unauthenticated attackers over the internet — ProxyLogon was exploited by nation-state actors before Microsoft released the patch.
An attacker with network access to Exchange's HTTPS port (443) can authenticate as any Exchange user without credentials, then write a web shell to the Exchange server. From there they have SYSTEM-level code execution, access to all email on the server, and typically a foothold into the Active Directory domain since Exchange servers are highly privileged by default.
Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability in its Exchange Control Panel that allows an unauthenticated attacker to send arbitrary HTTP requests as the Exchange server account. When chained with CVE-2021-27065, an attacker can write a web shell to disk and achieve remote code execution. The Exchange server account runs as SYSTEM, so exploitation results in full server compromise.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Affected OS versions
The HAFNIUM threat group exploited ProxyLogon in targeted attacks against US defence contractors, law firms, and infectious disease researchers before the patch was available. After public disclosure, over 250,000 Exchange servers were found to be compromised within days. Many organisations discovered web shells months after the fact when reviewing logs.
Manual remediation steps
⏱ 60–120 minutes including rebootStep 1 — Check Exchange Version and Patch Level
# Run on Exchange server
Get-ExchangeDiagnosticInfo -Server $env:COMPUTERNAME -Process EdgeTransport -Component VariantConfiguration -Settings GetSettingOverrides | Format-List
# Check installed Exchange updates
Get-Command exsetup.exe | ForEach-Object { $_.FileVersionInfo }
Step 2 — Apply Security Update
Step 3 — Check for Existing Compromise
# Microsoft released a detection script — download and run:
# https://github.com/microsoft/CSS-Exchange/tree/main/Security
# Run Test-ProxyLogon.ps1 on all Exchange servers
.\Test-ProxyLogon.ps1 -OutPath C:\Temp\ProxyLogon_Results
# Check for suspicious ASPX files in Exchange directories
Get-ChildItem -Path 'C:\inetpub\wwwroot\aspnet_client' -Recurse -Filter '*.aspx' |
Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
Get-ChildItem -Path 'C:\Program Files\Microsoft\Exchange Server' -Recurse -Filter '*.aspx' |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddMonths(-6) } |
Select-Object FullName, LastWriteTime
Verification
# Confirm patch level shows March 2021 SU or later
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup' | Select-Object MsiProductMajor, MsiProductMinor, MspFileVersion
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References