CVE-2020-17132
published 2020-12-10CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
PriorityP275critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EXPLOIT
EPSS
89.79%
99.8th percentile
Microsoft Exchange Remote Code Execution Vulnerability
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | microsoft_exchange_server_2013_cumulative_update_23 | >= 15.00.0 < publication | publication |
| microsoft | microsoft_exchange_server_2016_cumulative_update_17 | >= 15.01.0 < publication | publication |
| microsoft | microsoft_exchange_server_2016_cumulative_update_18 | >= 15.01.0 < publication | publication |
| microsoft | microsoft_exchange_server_2019_cumulative_update_6 | >= 15.02.0 < publication | publication |
| microsoft | microsoft_exchange_server_2019_cumulative_update_7 | >= 15.02.0 < publication | publication |
| msrc | microsoft_exchange_server_2010_service_pack_3 | — | — |
| msrc | microsoft_exchange_server_2013_cumulative_update_21 | — | — |
| msrc | microsoft_exchange_server_2013_cumulative_update_22 | — | — |
| msrc | microsoft_exchange_server_2013_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2013_service_pack_1 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_10 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_11 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_12 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_13 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_14 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_15 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_16 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_17 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_18 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_19 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_8 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_9 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/ecp/DLPPolicy/ManagePolicyFromISV.aspx
command[Diagnostics.Process]::start|28|
otherctl00$ResultPanePlaceHolder$contentContainer$upldCtrl
snort
alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ecp/DLPPolicy/ManagePolicyFromISV.aspx"; startswith; http.request_body; content:"ctl00$ResultPanePlaceHolder$contentContainer$upldCtrl"; content:"[Diagnostics.Process]::start|28|"; distance:0; reference:cve,CVE-2020-17132; reference:url,github.com/sudohyak/suricata-rules/blob/main/CVE-2020-17132/CVE-2020-17132.rules; reference:cve,2020-17132; classtype:attempted-admin; sid:2031506; rev:3; metadata:attack_target Server, created_at 2021_01_08, cve CVE_2020_17132, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07;)
- →Look for HTTP POST requests to the Exchange Control Panel DLP policy upload endpoint /ecp/DLPPolicy/ManagePolicyFromISV.aspx — this is the specific attack surface targeted by the exploit.
- →Detect PowerShell/CLR process-spawning payload in the HTTP request body: the string '[Diagnostics.Process]::start(' (with '(' encoded as hex |28|) indicates active exploitation via the DLP policy file upload.
- →The exploit abuses the New-DlpPolicy cmdlet and DlpUtils AddTenantDlpPolicy code path; monitor Exchange audit logs for unexpected invocations of New-DlpPolicy by non-administrative accounts or accounts newly granted the 'Data Loss Prevention' role. ↗
- →Exploitation requires an authenticated user with the 'Data Loss Prevention' role (members of 'Compliance Management' or 'Organization Management' role groups qualify). Alert on role-group membership changes to these groups as a precursor indicator. ↗
- →Successful exploitation results in code execution as SYSTEM on the Exchange server; monitor for SYSTEM-level child processes spawned from the Exchange worker process (w3wp.exe) as a post-exploitation indicator. ↗
- ·The Suricata/Snort rule targets inbound traffic to $HTTP_SERVERS and $HOME_NET — ensure Exchange ECP servers are included in these variable definitions for the rule to fire correctly.
- ·The Metasploit module was tested specifically against Exchange Server 2016 CU19 on Windows Server 2016; validate rule/detection coverage against other affected Exchange versions (2013, 2019) in your environment. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_msrc9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vqv9-x245-gqwv: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
ghsa_unreviewed·2022-05-24·CVSS 6.6
CVE-2020-17132 [MEDIUM] CWE-94 GHSA-vqv9-x245-gqwv: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17117, CVE-2020-17141, CVE-2020-17142, CVE-2020-17144.
GHSA
GHSA-5rwf-4w32-44c4: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
ghsa_unreviewed·2022-05-24·CVSS 6.6
CVE-2020-17141 [MEDIUM] CWE-94 GHSA-5rwf-4w32-44c4: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17117, CVE-2020-17132, CVE-2020-17142, CVE-2020-17144.
GHSA
GHSA-wv8q-jq9m-rpq3: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
ghsa_unreviewed·2022-05-24·CVSS 6.6
CVE-2020-17142 [MEDIUM] CWE-94 GHSA-wv8q-jq9m-rpq3: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17117, CVE-2020-17132, CVE-2020-17141, CVE-2020-17144.
GHSA
GHSA-68q4-hg7f-7p9c: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
ghsa_unreviewed·2022-05-24·CVSS 6.6
CVE-2020-17144 [MEDIUM] CWE-502 GHSA-68q4-hg7f-7p9c: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17117, CVE-2020-17132, CVE-2020-17141, CVE-2020-17142.
GHSA
GHSA-h8vr-6vfm-c62r: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2020-17117 [CRITICAL] GHSA-h8vr-6vfm-c62r: , aka 'Microsoft Exchange Remote Code Execution Vulnerability'
, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17132, CVE-2020-17141, CVE-2020-17142, CVE-2020-17144.
Project0
Project Zero RCA: CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery
project_zero·CVSS 9.1
CVE-2021-26855 [CRITICAL] Project Zero RCA: CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery
# CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery
*Anthony Weems, Michael Weber, Dallas Kaman*
## The Basics
**Disclosure or Patch Date:** March 2 2021
**Product:** Microsoft Microsoft Exchange Server
**Advisory:** https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
**Affected Versions:** [Exchange 2010, 2013, 2016, and 2019](https://techcommunity.microsoft.com/t5/exchange-team-blog/march-2021-exchange-server-security-updates-for-older-cumulative/ba-p/2192020) before KB5000871.
**First Patched Version:** [KB5000871](https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-2-2021-kb5000871-9800a6bb-0a21-4ee7-b9da-fa85b3e1d23b)
**Issue/Bug Report:** N/A
**Patch CL:** N/A
**Bug-
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2021-03-09·CVSS 7.8
CVE-2021-26857 [CRITICAL] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: Is this vulnerability being used in an active attack?
Yes. The vulnerability described in this CVE is one of four vulnerabilities that are being exploited in an active attack. The security updates address this attack. More information can be found here: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server.
What is the target for this attack?
The initial attack in this attack chain targets an Exchange On-prem server that is able to receive untrusted connections from an external source. In addition, the Exchange server would need to be running Microsoft Exchange Server 2013, 2016, or 2019.
Where can I get more information about how to protect myself from the vulnerabilities?
Pleas
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2021-03-09·CVSS 9.1
CVE-2021-26855 [CRITICAL] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: Is this vulnerability being used in an active attack?
Yes. The vulnerability described in this CVE is one of four vulnerabilities that are being exploited in an active attack. The security updates address this attack. More information can be found here: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server.
What is the target for this attack?
The initial attack in this attack chain targets an Exchange On-prem server that is able to receive untrusted connections from an external source. In addition, the Exchange server would need to be running Microsoft Exchange Server 2013, 2016, or 2019.
Where can I get more information about how to protect myself from the vulnerabilities?
Pleas
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2021-03-09·CVSS 7.8
CVE-2021-27065 [CRITICAL] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: Is this vulnerability being used in an active attack?
Yes. The vulnerability described in this CVE is one of four vulnerabilities that are being exploited in an active attack. The security updates address this attack. More information can be found here: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server.
What is the target for this attack?
The initial attack in this attack chain targets an Exchange On-prem server that is able to receive untrusted connections from an external source. In addition, the Exchange server would need to be running Microsoft Exchange Server 2013, 2016, or 2019.
Where can I get more information about how to protect myself from the vulnerabilities?
Pleas
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2021-03-09·CVSS 7.8
CVE-2021-26858 [CRITICAL] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: Is this vulnerability being used in an active attack?
Yes. The vulnerability described in this CVE is one of four vulnerabilities that are being exploited in an active attack. The security updates address this attack. More information can be found here: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server.
What is the target for this attack?
The initial attack in this attack chain targets an Exchange On-prem server that is able to receive untrusted connections from an external source. In addition, the Exchange server would need to be running Microsoft Exchange Server 2013, 2016, or 2019.
Where can I get more information about how to protect myself from the vulnerabilities?
Pleas
Microsoft
Microsoft Exchange Remote Code Execution Vulnerability
vendor_msrc·2020-12-08·CVSS 9.1
CVE-2020-17132 [CRITICAL] Microsoft Exchange Remote Code Execution Vulnerability
Microsoft Exchange Remote Code Execution Vulnerability
FAQ: What can cause this vulnerability?
The vulnerability occurs due to improper validation of cmdlet arguments.
Does the attacker need to be in an authenticated role in the Exchange Server?
Yes, the attacker must be authenticated.
Microsoft Exchange Server: Microsoft Exchange Server
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
Reference: http://www.microsoft.com/download/details.aspx?familyid=64b1d61d-63e8-4d41-923d-0f89f1982739
Reference: https://support.microsoft.com/help/4593466
Reference: http://www.microsoft.com/download/details.aspx?family
Suricata
ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)
suricata·2021-01-08·CVSS 9.1
CVE-2020-17132 [CRITICAL] ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)
ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)
Rule: alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ecp/DLPPolicy/ManagePolicyFromISV.aspx"; startswith; http.request_body; content:"ctl00$ResultPanePlaceHolder$contentContainer$upldCtrl"; content:"[Diagnostics.Process]::start|28|"; distance:0; reference:cve,CVE-2020-17132; reference:url,github.com/sudohyak/suricata-rules/blob/main/CVE-2020-17132/CVE-2020-17132.rules; reference:cve,2020-17132; classtype:attempted-admin; sid:2031506; rev:3; metadata:attack_target Server, created_at 2021_01_08, cve CVE_2020_17132, deployment Perimeter, deployment Interna
Trendmicro
December Patch Tuesday Fixes Exchange, SMB
blogs_trendmicro·2020-12-09·CVSS 6.6
[MEDIUM] December Patch Tuesday Fixes Exchange, SMB
# December Patch Tuesday Fixes Exchange, SMB
The last set of updates for the year includes 58 patches for the Microsoft Office suite.
By: Trend Micro
2020/12/09
Read time: ( words)
Save to Folio
Updated on 12/9/2020 02:37PM PST to include Trend Micro Deep Security and Vulnerability Protection rules.
The last set of updates for the year includes 58 patches for the Microsoft Office suite. Of the total number, nine have been rated Critical and 46 as Important. A significant number of updates fixes gaps in MS Exchange vulnerable to remote code execution (RCE) and information disclosure, as well as a server message block (SMB) gap also noted for the latter vulnerability. No zero days have been observed, though several vulnerabilities have been deemed as likely for abuse. Six of the total
Tenable
Microsoft’s December 2020 Patch Tuesday Addresses 58 CVEs including CVE-2020-25705 (SAD DNS)
blogs_tenable·2020-12-08·CVSS 7.4
[HIGH] Microsoft’s December 2020 Patch Tuesday Addresses 58 CVEs including CVE-2020-25705 (SAD DNS)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
December 2020 Patch Tuesday – 58 Vulnerabilities, 9 Critical, Windows Exchange, Hyper-V, SharePoint, Adobe
blogs_qualys·2020-12-08·CVSS 8.5
[HIGH] December 2020 Patch Tuesday – 58 Vulnerabilities, 9 Critical, Windows Exchange, Hyper-V, SharePoint, Adobe
This month’s Microsoft Patch Tuesday addresses 58 vulnerabilities with 9 of them labeled as Critical. The 9 Critical vulnerabilities cover Exchange, SharePoint, Hyper-V, Chakra Scripting, and several other workstation vulnerabilities. Adobe released patches today for Experience Manager, Prelude, Lightroom and pre-notification security advisory for Acrobat and Reader .
## Workstation Patches
Today’s Patch Tuesday fixes vulnerabilities that would impact workstations. The Office, Edge, Chakra vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
## Microsoft Exchange RCE
Microsoft patched five Remote Code Execution vu
Qualys
December 2020 Patch Tuesday – 58 Vulnerabilities, 9 Critical, Windows Exchange, Hyper-V, SharePoint, Adobe | Qualys
blogs_qualys·2020-12-08·CVSS 8.5
[HIGH] December 2020 Patch Tuesday – 58 Vulnerabilities, 9 Critical, Windows Exchange, Hyper-V, SharePoint, Adobe | Qualys
This month’s Microsoft Patch Tuesday addresses 58 vulnerabilities with 9 of them labeled as Critical. The 9 Critical vulnerabilities cover Exchange, SharePoint, Hyper-V, Chakra Scripting, and several other workstation vulnerabilities. Adobe released patches today for Experience Manager, Prelude, Lightroom and pre-notification security advisory for Acrobat and Reader.
### Workstation Patches
Today’s Patch Tuesday fixes vulnerabilities that would impact workstations. The Office, Edge, Chakra vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
### Microsoft Exchange RCE
Microsoft patched five Remote Code Execution v
2020-12-10
Published