CVE-2021-34523
Microsoft Exchange Server Privilege Escalation Vulnerability
Description
CVE-2021-34523 is a CRITICAL privilege escalation vulnerability in Microsoft Exchange Server, carrying a CVSS 3.1 score of 9.0. The vulnerability allows an unauthenticated attacker to escalate privileges on the Exchange server, and it is a key component of the ProxyShell attack chain alongside CVE-2021-34473 and CVE-2021-31207. Exploitation requires local access but no authentication, and the scope is changed, meaning it can impact resources beyond the vulnerable component itself. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.93998 (99.89th percentile), this is among the most actively exploited vulnerabilities tracked. The KEV data confirms a known ransomware association.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34523(Patch, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-21-822/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34523(US Government Resource)
Weakness Type
Unspecified Weakness Type
CVE-2021-34523 does not have an officially assigned CWE classification. The vulnerability is a privilege escalation flaw in Microsoft Exchange Server that allows bypassing the security context used by the Exchange PowerShell backend. The flaw exists in the way Exchange handles mailbox-level access tokens, enabling an attacker to impersonate the Exchange machine account.
As part of the ProxyShell exploit chain, this vulnerability works in conjunction with CVE-2021-34473 (pre-authentication path confusion) and CVE-2021-31207 (post-authentication arbitrary file write). Together, these three vulnerabilities enable complete unauthenticated remote code execution against Exchange servers. The privilege escalation component specifically allows the attacker to execute arbitrary Exchange PowerShell commands with SYSTEM-level privileges.
Impact Analysis
CVE-2021-34523 carries a CVSS 3.1 score of 9.0 (CRITICAL) with Changed Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker access to all emails, contacts, calendar entries, and attachments stored on the Exchange server. Credentials, internal communications, and sensitive business data are fully exposed.
Integrity (HIGH): Attackers can modify mailbox content, send emails as any user, alter Exchange configurations, install webshells, and deploy persistent backdoors across the server infrastructure.
Availability (NONE): The CVSS vector indicates no direct availability impact from the privilege escalation itself. However, in practical attack chains, availability may be affected through subsequent actions taken with elevated privileges.
Scope Changed: The scope is Changed (C), meaning exploitation can impact resources beyond the Exchange Server component itself. An attacker gaining SYSTEM-level Exchange PowerShell access can pivot to other systems in the network, access Active Directory, and compromise the broader enterprise environment.
With an EPSS score of 0.93998 (99.89th percentile), this vulnerability is among the most exploited ever tracked, demanding immediate remediation.
Exploit Maturity
CVE-2021-34523 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been extensively exploited as part of the ProxyShell attack chain. The EPSS score of 0.93998 (99.89th percentile) places it among the most widely exploited vulnerabilities ever tracked. Multiple public exploit tools and Metasploit modules are available.
Ransomware association: The KEV catalog confirms a known ransomware association for CVE-2021-34523. Ransomware groups including LockFile, Conti, and Hive have actively exploited ProxyShell vulnerabilities to gain initial access and deploy ransomware across enterprise networks.
Attack surface: Fully weaponized exploit code is publicly available. The ProxyShell chain was demonstrated at Pwn2Own 2021 and subsequently exploited at massive scale. Internet-facing Exchange servers are trivially discoverable via Shodan, making this vulnerability extremely attractive to threat actors.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. Given the ransomware association and widespread exploitation, all organizations should treat this as their highest remediation priority for any unpatched Exchange servers.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the Microsoft advisory at MSRC for specific patch guidance. Install the latest Exchange Server Cumulative Update and Security Update.
- Verify all Exchange servers are patched. Identify every Exchange server in your environment, including those that may have been forgotten or decommissioned but still running. Use the Microsoft Exchange Server Health Checker script to verify patch status.
- Scan for webshells and indicators of compromise. Given the extensive exploitation history, assume compromise and conduct a thorough investigation. Check for webshells in IIS directories, unexpected scheduled tasks, new local administrator accounts, and lateral movement indicators.
- Implement network-level protections. Restrict access to Exchange management endpoints. Place Exchange behind a reverse proxy or web application firewall. Limit administrative access to dedicated management networks.
- Consider migration to Exchange Online. ProxyShell and related Exchange vulnerabilities highlight the ongoing risk of self-hosted Exchange. Evaluate migrating to Microsoft 365 / Exchange Online to reduce the on-premises attack surface.
- Update detection and monitoring rules. Ensure IDS/IPS, EDR, and SIEM rules detect ProxyShell exploitation patterns, including suspicious PowerShell execution, webshell deployment, and unauthorized mailbox access.
Technical Details
CVE-2021-34523 is a CRITICAL-severity privilege escalation vulnerability in Microsoft Exchange Server. The attack vector is local, with low complexity, requiring no authentication and no user interaction. The scope is changed, meaning exploitation impacts resources beyond the vulnerable component.
Technical mechanism: The vulnerability exists in the Exchange PowerShell backend's handling of access tokens. When processing requests to the Exchange PowerShell endpoint, the server fails to properly validate the access token's mailbox identity. An attacker can supply a specially crafted token that causes Exchange to execute PowerShell commands in the context of the SYSTEM account, bypassing normal authorization checks.
ProxyShell chain: In the complete ProxyShell attack: (1) CVE-2021-34473 provides pre-authentication access to the Exchange PowerShell endpoint via a path confusion vulnerability, (2) CVE-2021-34523 escalates privileges to run arbitrary Exchange PowerShell commands as SYSTEM, and (3) CVE-2021-31207 allows writing arbitrary files to the server via mailbox export, enabling webshell deployment.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N reflects local access, low complexity, no privileges or user interaction needed, changed scope, and high confidentiality and integrity impact with no direct availability impact.
Frequently Asked Questions
Is CVE-2021-34523 being actively exploited?
Yes, CVE-2021-34523 is among the most actively exploited vulnerabilities ever tracked. It is a core component of the ProxyShell attack chain used by multiple threat actors including ransomware groups. The EPSS score of 0.93998 (99.89th percentile) confirms its extreme exploitation prevalence. It is listed in the CISA KEV catalog with a confirmed ransomware association.
Which products are affected by CVE-2021-34523?
CVE-2021-34523 affects Microsoft Exchange Server, including Exchange Server 2013, 2016, and 2019. All organizations running on-premises Exchange servers that have not applied the July 2021 or later security updates are vulnerable. Exchange Online (Microsoft 365) is not affected.
How do I fix CVE-2021-34523?
Apply the latest Exchange Server Cumulative Update and Security Update per Microsoft's advisory. Use the Exchange Server Health Checker to verify patch status. Conduct a thorough compromise assessment including webshell scanning, review of scheduled tasks, and analysis of authentication logs. Implement network-level protections and consider migration to Exchange Online.
How severe is CVE-2021-34523?
CVE-2021-34523 is rated CRITICAL with a CVSS 3.1 score of 9.0 and a Changed scope. Its EPSS score of 0.93998 (99.89th percentile) makes it one of the most exploited vulnerabilities tracked. It has a confirmed ransomware association and the CISA remediation deadline was 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.