CVE-2020-17144
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2020-17144 is a HIGH-severity remote code execution vulnerability in Microsoft Exchange Server 2010 with a CVSS 3.1 score of 8.4. The vulnerability exists because Exchange Server improperly validates cmdlet arguments, enabling deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. The attack can cross security boundaries (Changed Scope), making it possible to compromise resources beyond the vulnerable Exchange component. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.92725 (99.75th percentile) indicates near-certain exploitation probability, placing it among the most actively exploited vulnerabilities tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2010 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17144(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17144(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17144(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2020-17144 is classified under CWE-502 — Deserialization of Untrusted Data. This weakness occurs when an application deserializes data from an untrusted source without proper validation or sanitization. During deserialization, attacker-controlled data can instantiate arbitrary objects, invoke methods, and manipulate application state, frequently leading to remote code execution.
In the context of Microsoft Exchange Server, deserialization vulnerabilities are particularly critical because Exchange processes complex serialized data structures in cmdlet arguments and PowerShell remoting sessions. Attackers can craft malicious serialized payloads that, when processed by Exchange, execute arbitrary code with the privileges of the Exchange service account, which typically holds elevated domain permissions.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2020-17144 carries a CVSS 3.1 score of 8.4 (HIGH) with Changed Scope.
Confidentiality (HIGH): Successful exploitation grants access to all email data stored on the Exchange server, including sensitive corporate communications, attachments, address books, and potentially cached credentials.
Integrity (HIGH): An attacker can modify Exchange configurations, forge or alter email messages, install backdoors, and manipulate mail flow rules to intercept or redirect communications.
Availability (HIGH): Complete disruption of email services is possible, including denial of service, data destruction, or rendering the Exchange server inoperable.
Scope Changed: The vulnerability has a Changed Scope (C), meaning exploitation can impact resources beyond the vulnerable Exchange Server component, potentially compromising Active Directory, connected systems, and the broader enterprise network.
With an EPSS score of 0.92725 (99.75th percentile), this vulnerability has near-certain exploitation probability in real-world environments.
Exploit Maturity
CVE-2020-17144 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: The vulnerability has been actively exploited, with public exploit code available. The EPSS score of 0.92725 (99.75th percentile) confirms it is among the most exploited vulnerabilities globally.
Ransomware association: No direct ransomware association has been confirmed per KEV data. However, Exchange Server vulnerabilities have been heavily targeted by ransomware operators and nation-state actors, particularly following the ProxyLogon and ProxyShell campaigns.
Attack surface: The vulnerability requires authenticated access with high privileges, but the Changed Scope means successful exploitation extends impact beyond Exchange itself. Public proof-of-concept exploits increase the risk of widespread exploitation.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Given the critical role of Exchange servers in enterprise infrastructure, organizations should treat remediation as an urgent priority.
Remediation
- Apply Microsoft security updates immediately. Install the December 2020 security updates for Exchange Server 2010 per Microsoft's advisory at msrc.microsoft.com.
- Migrate from Exchange Server 2010. Exchange Server 2010 reached end of support on October 13, 2020. Plan immediate migration to Exchange Server 2016, 2019, or Exchange Online to receive ongoing security updates.
- Restrict Exchange administrative access. Limit the number of accounts with Exchange administrative privileges. Implement Privileged Access Workstations and just-in-time access controls for Exchange management.
- Monitor for exploitation indicators. Review Exchange server logs, IIS logs, and Windows event logs for suspicious cmdlet execution, unusual PowerShell remoting activity, and indicators of deserialization attacks.
- Implement network segmentation. Isolate Exchange servers from sensitive internal networks to limit the impact of the Changed Scope exploitation vector.
- Conduct post-compromise assessment. Given the high exploitation probability, audit Exchange servers for signs of prior compromise including web shells, unauthorized mailbox access rules, and suspicious mail flow configurations.
Technical Details
CVE-2020-17144 is a HIGH-severity remote code execution vulnerability in Microsoft Exchange Server 2010 that can be exploited over the network. The attack complexity is low, but high privileges and user interaction are required.
Technical mechanism: The vulnerability exists because Microsoft Exchange Server improperly validates cmdlet arguments, leading to deserialization of untrusted data. An authenticated attacker with administrative Exchange privileges can craft specially designed cmdlet arguments containing malicious serialized .NET objects. When Exchange deserializes these arguments without proper type validation, arbitrary code execution is achieved in the security context of the Exchange service.
CVSS 3.1 vector analysis: AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H — The network attack vector with Changed Scope is significant because it indicates the exploitation can compromise resources beyond the Exchange Server itself. The high privilege requirement limits the initial attack surface, but administrative credentials for Exchange can be obtained through credential theft or phishing.
Affected products: Microsoft Exchange Server 2010.
Related CVEs: This vulnerability is unique from other Exchange RCE vulnerabilities but is part of a broader pattern of deserialization issues in Exchange's cmdlet processing pipeline.
Frequently Asked Questions
Is CVE-2020-17144 being actively exploited?
Yes, CVE-2020-17144 is being actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.92725 (99.75th percentile) confirms near-certain exploitation probability, making immediate remediation critical.
Which products are affected by CVE-2020-17144?
CVE-2020-17144 affects Microsoft Exchange Server 2010. Since Exchange 2010 reached end of support in October 2020, organizations still running this version should prioritize immediate migration to a supported version such as Exchange Server 2016, 2019, or Exchange Online.
How do I fix CVE-2020-17144?
Apply the December 2020 security updates from Microsoft for Exchange Server 2010. More importantly, migrate to a supported Exchange Server version since Exchange 2010 has reached end of life. Implement network segmentation, restrict administrative access, and monitor for indicators of prior compromise.
How severe is CVE-2020-17144?
CVE-2020-17144 is rated HIGH with a CVSS 3.1 score of 8.4. The Changed Scope means exploitation can impact resources beyond Exchange itself, potentially compromising the broader enterprise network. With an EPSS score of 0.92725 (99.75th percentile), it ranks among the most exploited vulnerabilities worldwide.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.