CVE-2021-31207
Microsoft Exchange Server Security Feature Bypass Vulnerability
Description
CVE-2021-31207 is a medium-severity security feature bypass vulnerability in Microsoft Exchange Server. The vulnerability allows a highly privileged attacker to bypass security features on an Exchange Server, and it is a key component of the "ProxyShell" attack chain. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is known to be leveraged in ransomware campaigns. With an EPSS score of 93.91% (99.9th percentile), the probability of exploitation is near certain despite its medium CVSS rating, highlighting the importance of the ProxyShell chain in real-world attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31207(Patch, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-21-819/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31207(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type occurs when software allows the upload of files without properly validating the file type, which can lead to arbitrary code execution. In the context of CVE-2021-31207, Microsoft Exchange Server fails to properly restrict file uploads, allowing an attacker to write a webshell to the server after bypassing authentication through the ProxyShell chain.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2021-31207 carries a CVSS 3.1 score of 6.6 (MEDIUM), but this rating understates the real-world risk when the vulnerability is chained with other ProxyShell components. The attack vector is network-based but has high attack complexity and requires high privileges, meaning standalone exploitation requires significant prerequisites. However, when chained with CVE-2021-34473 (pre-authentication path confusion) and CVE-2021-34523 (privilege escalation), these requirements are effectively bypassed. Successful exploitation fully compromises confidentiality, integrity, and availability of the Exchange Server. The EPSS score of 93.91% (99.9th percentile) indicates near-certain exploitation activity. This vulnerability is known to be used in ransomware campaigns, and the ProxyShell chain has been one of the most widely exploited Exchange Server attack vectors, making unpatched Exchange Servers critical targets for threat actors.
Exploit Maturity
CVE-2021-31207 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware campaigns. Public exploit code is available for the ProxyShell attack chain via Packet Storm Security (Microsoft Exchange ProxyShell Remote Code Execution). Additional details have been published by the Zero Day Initiative (ZDI-21-819). The EPSS score of 93.91% (99.9th percentile) indicates near-certain exploitation activity. CVE-2021-31207 is commonly chained with CVE-2021-34473 (pre-authentication path confusion) and CVE-2021-34523 (Exchange PowerShell privilege escalation) to form the complete ProxyShell attack chain, which allows unauthenticated remote code execution on Exchange Servers. Federal agencies were required to remediate this vulnerability by 2021-11-17.
Remediation
- Apply vendor security updates immediately as directed by the CISA KEV catalog: Apply updates per vendor instructions. Install the May 2021 Cumulative Update for Exchange Server that addresses CVE-2021-31207 and the related ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523).
- Verify that all Exchange Servers in the environment have been updated to patched versions. Ensure that both the May 2021 security updates and any subsequent cumulative updates have been applied, as the ProxyShell chain requires all three vulnerabilities to be patched.
- Restrict external access to Exchange Server's Autodiscover and MAPI endpoints where possible, and place Exchange Servers behind a web application firewall (WAF) configured to detect ProxyShell exploitation patterns.
- Conduct forensic review of Exchange Servers for webshells, suspicious PowerShell activity, and unauthorized mailbox export requests. Check IIS logs for anomalous requests to the Autodiscover and PowerShell virtual directories.
- Implement network segmentation to isolate Exchange Servers from other critical infrastructure, and monitor Exchange Server event logs for indicators of compromise associated with ProxyShell exploitation.
Technical Details
CVE-2021-31207 is a security feature bypass vulnerability in Microsoft Exchange Server related to CWE-434 (Unrestricted Upload of File with Dangerous Type). The attack vector is network-based with high complexity (CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), requiring high-level privileges when exploited in isolation. However, as part of the ProxyShell chain, the high privilege requirement is circumvented by CVE-2021-34523 (Exchange PowerShell backend privilege escalation), and the authentication requirement is bypassed by CVE-2021-34473 (pre-authentication path confusion via Autodiscover). The exploitation flow involves: first accessing the Exchange backend without authentication via the path confusion vulnerability, then escalating to Exchange admin privileges via the PowerShell backend, and finally using CVE-2021-31207 to write a webshell to disk by exploiting the file upload security bypass. This complete chain transforms three individually moderate-to-low severity vulnerabilities into an unauthenticated remote code execution attack against Exchange Servers.
Frequently Asked Questions
Is CVE-2021-31207 being actively exploited?
Yes. CVE-2021-31207 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation as part of the ProxyShell attack chain. It is also known to be used in ransomware campaigns. The EPSS score of 93.91% (99.9th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-31207?
CVE-2021-31207 affects Microsoft Exchange Server. It is part of the ProxyShell vulnerability chain alongside CVE-2021-34473 and CVE-2021-34523. Organizations running on-premises Exchange Servers should consult the Microsoft Security Advisory for specific affected versions and cumulative updates.
How do I fix CVE-2021-31207?
Apply the May 2021 Cumulative Update and subsequent patches from Microsoft for Exchange Server. Ensure all three ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) are patched. Restrict external access to Exchange endpoints, deploy a WAF, and conduct forensic analysis for existing webshells.
How severe is CVE-2021-31207?
CVE-2021-31207 has a CVSS 3.1 score of 6.6 (MEDIUM) when considered individually, but as part of the ProxyShell chain it enables unauthenticated remote code execution on Exchange Servers. The association with ransomware campaigns and the extremely high EPSS score (93.91%) make immediate remediation critical despite the moderate standalone CVSS rating.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.