CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2021-34473 is a CRITICAL remote code execution vulnerability affecting Microsoft Exchange Server, carrying a CVSS 3.1 score of 9.1. This vulnerability is a key component of the ProxyShell attack chain, allowing an unauthenticated attacker to execute arbitrary code on affected Exchange Server instances through a Server-Side Request Forgery (SSRF) flaw in the URL normalization process. When chained with CVE-2021-34523 and CVE-2021-31207, it enables complete pre-authentication remote code execution. Affected products include Microsoft Exchange Server 2013, 2016, and 2019. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with an accelerated remediation deadline of 2021-11-17. With an EPSS score of 0.94256 (99.93rd percentile), this vulnerability demonstrates extremely high real-world exploitation probability. This vulnerability has known ransomware associations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473(Patch, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-21-821/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2021-34473 is classified under CWE-918 — Server-Side Request Forgery (SSRF). SSRF occurs when a web application fetches a remote resource based on a user-supplied URL without properly validating the destination. This allows an attacker to coerce the server into making requests to unintended destinations, potentially accessing internal services, bypassing access controls, or reading sensitive data from the server's network perspective.
In the context of Microsoft Exchange Server, the SSRF vulnerability exists in the URL normalization component of the Client Access Service (CAS). By crafting specific URL patterns, an attacker can bypass authentication checks and access backend Exchange services that should only be available to authenticated users. This SSRF primitive is particularly dangerous because it serves as the entry point for the ProxyShell attack chain, enabling subsequent exploitation of privilege escalation and remote code execution vulnerabilities.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-34473 carries a CVSS 3.1 score of 9.1 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation enables an unauthenticated attacker to access Exchange Server backend services, exposing email content, user credentials, Active Directory information, and sensitive organizational data processed by the mail server.
Integrity (HIGH): Through the ProxyShell chain, attackers can write arbitrary files to the Exchange Server, deploy web shells, modify Exchange configurations, and establish persistent backdoor access to the email infrastructure.
Availability (NONE per CVSS): The CVSS vector rates availability impact as NONE for this specific vulnerability in isolation. However, when exploited as part of the ProxyShell chain, attackers commonly deploy ransomware or destructive payloads that severely impact availability.
Scope Unchanged: The impact is contained within the Exchange Server component, though the server's central role in enterprise communications means compromise effectively impacts the entire organization.
With an EPSS score of 0.94256 (99.93rd percentile) and confirmed ransomware associations, ProxyShell represents one of the most actively exploited Exchange Server vulnerabilities following the ProxyLogon attacks of early 2021.
Exploit Maturity
CVE-2021-34473 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog with an accelerated remediation deadline.
Exploit status: Multiple public exploits are available, including Metasploit modules and standalone proof-of-concept scripts demonstrating the complete ProxyShell attack chain. The vulnerability was presented at Black Hat USA 2021 by Orange Tsai, and exploitation began in the wild shortly after disclosure. The exploit is reliable and widely used by both APT groups and cybercriminal organizations.
Ransomware association: This vulnerability has confirmed ransomware associations. Multiple ransomware families including LockFile, Conti, and Hive have leveraged ProxyShell as an initial access vector to compromise Exchange Servers and deploy ransomware across enterprise networks.
Attack surface: Exchange Server's Autodiscover and Client Access Service (CAS) components are typically exposed to the internet on port 443. The vulnerability requires no authentication, making it directly exploitable from the internet against any unpatched Exchange Server.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17, an accelerated timeline reflecting the active mass exploitation. All organizations should have remediated this vulnerability as a matter of extreme urgency.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Install the July 2021 Microsoft Exchange Server cumulative updates from the Microsoft Security Advisory for all affected Exchange Server versions.
- Verify affected product versions in your environment. Identify all instances of Microsoft Exchange Server 2013, 2016, and 2019 in your infrastructure. Use vulnerability scanning and the Microsoft Exchange Health Checker tool to verify patch levels.
- Scan for web shells and indicators of compromise. ProxyShell exploitation commonly results in web shell deployment. Scan Exchange Server file systems for suspicious ASPX files in web-accessible directories. Use Microsoft's safety scanner and EOMT tool for automated detection.
- Review Exchange Server logs for exploitation signs. Examine IIS logs for suspicious URL patterns containing autodiscover, MAPI, or EWS paths with unusual query parameters. Check for unexpected mailbox export requests and suspicious PowerShell activity.
- Implement network-level protections. Restrict direct internet access to Exchange Server where possible. Deploy web application firewalls with rules specifically targeting ProxyShell exploitation patterns. Consider migrating to Exchange Online to reduce the attack surface.
- Conduct a comprehensive incident response if compromise is suspected. If any indicators of ProxyShell exploitation are found, initiate a full incident response including forensic analysis, credential rotation, and network-wide scanning for lateral movement.
Technical Details
CVE-2021-34473 is a CRITICAL-severity vulnerability in Microsoft Exchange Server that can be exploited remotely over the network with no authentication and no user interaction required. The attack complexity is low.
Technical mechanism: The vulnerability exists in the URL normalization logic of Exchange Server's Client Access Service (CAS) proxy. When processing incoming HTTP requests, the CAS normalizes URLs before routing them to backend services. A flaw in this normalization process allows an attacker to craft specific URL patterns that bypass the authentication enforcement layer. By manipulating the URL path to include specific Autodiscover-related patterns, the attacker can access backend Exchange Web Services (EWS) and PowerShell endpoints without authentication. This SSRF primitive forms the foundation of the ProxyShell attack chain, where it is combined with CVE-2021-34523 (privilege escalation via Exchange PowerShell) and CVE-2021-31207 (arbitrary file write via mailbox export) to achieve full remote code execution.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reflects an Attack Vector of NETWORK, Attack Complexity of LOW, Privileges Required of NONE, User Interaction of NONE, Scope UNCHANGED, and HIGH impact on Confidentiality and Integrity with no direct Availability impact. The pre-authentication SSRF provides the critical initial access required for the ProxyShell chain.
Frequently Asked Questions
Is CVE-2021-34473 being actively exploited?
Yes, CVE-2021-34473 has been under active mass exploitation since August 2021 and is listed in CISA's Known Exploited Vulnerabilities catalog with an accelerated deadline. It is the initial entry point for the ProxyShell attack chain. Multiple ransomware families including LockFile, Conti, and Hive have used ProxyShell. The EPSS score of 0.94256 (99.93rd percentile) confirms extremely high exploitation activity.
Which products are affected by CVE-2021-34473?
Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019 are affected. Any on-premises Exchange Server that has not applied the July 2021 cumulative updates (or later) is vulnerable. Exchange Online is not affected. Organizations should use the Microsoft Exchange Health Checker to verify patch levels.
How do I fix CVE-2021-34473?
Apply the July 2021 Microsoft Exchange Server cumulative updates for all affected versions. After patching, scan for web shells and indicators of compromise, as exploitation may have occurred before the patch was applied. Review IIS logs for suspicious URL patterns and consider migrating to Exchange Online to reduce future attack surface.
How severe is CVE-2021-34473?
CVE-2021-34473 is rated CRITICAL with a CVSS 3.1 score of 9.1. With an EPSS score of 0.94256 (99.93rd percentile), it is among the most exploited vulnerabilities tracked. It requires no authentication, enables pre-authentication remote code execution via the ProxyShell chain, and has confirmed ransomware associations. CISA set an accelerated remediation deadline of 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.