cbcvebase.
CVE-2021-28481
published 2021-04-13

CVE-2021-28481: Microsoft Exchange Server Remote Code Execution Vulnerability

PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
36.49%
98.3th percentile
Microsoft Exchange Server Remote Code Execution Vulnerability

Affected

13 ranges
VendorProductVersion rangeFixed in
microsoftexchange_server
microsoftexchange_server
microsoftexchange_server
microsoftmicrosoft_exchange_server_2013_cumulative_update_23>= 15.00.0 < 15.00.1497.01515.00.1497.015
microsoftmicrosoft_exchange_server_2016_cumulative_update_19>= 15.01.0 < 15.01.2176.01215.01.2176.012
microsoftmicrosoft_exchange_server_2016_cumulative_update_20>= 15.01.0 < 15.01.2242.00815.01.2242.008
microsoftmicrosoft_exchange_server_2019_cumulative_update_8>= 15.02.0 < 15.02.0792.01315.02.0792.013
microsoftmicrosoft_exchange_server_2019_cumulative_update_9>= 15.02.0 < 15.02.0858.01015.02.0858.010
msrcmicrosoft_exchange_server_2013_cumulative_update_23
msrcmicrosoft_exchange_server_2016_cumulative_update_19
msrcmicrosoft_exchange_server_2016_cumulative_update_20
msrcmicrosoft_exchange_server_2019_cumulative_update_8
msrcmicrosoft_exchange_server_2019_cumulative_update_9

Detection & IOCsextracted from sources · hover to see the quote

path/owa/
path/ews/wssecurity
path/owa/auth/logon.aspx
cookieX-BackEndCookie={{email}}={{base64(hex_decode(rawXor))}}
otherX-AnchorMailbox header
otherhttp.favicon.hash:1768726119
path/owa/auth/errorFE.aspx
snort
SID 57403
snort
SID 57404
snort
SID 57411
snort
SID 57414
  • Exploit probe begins with a GET to /owa/ to extract the X-FEServer response header, which leaks the internal server name used to craft the forged back-end cookie.
  • The attack uses a forged X-BackEndCookie whose value is a Base64-encoded XOR-obfuscated string (each byte XOR'd with 0xFF) encoding the target server name, port 444, OWA path, and a timestamp.
  • A successful SSRF/ACL-bypass response is a 302 redirect containing both X-Calculatedbetarget and X-Owa-Error response headers.
  • The exploit POST targets the /ews/wssecurity endpoint with Content-Type: application/x-www-form-urlencoded and the crafted X-BackEndCookie and X-AnchorMailbox headers.
  • Shodan/FOFA fingerprinting for exposed Exchange servers: favicon hash 1768726119 or page title 'outlook' can identify targets.
  • CVE-2021-28481 is grouped with CVE-2021-28480, CVE-2021-28482, and CVE-2021-28483; all four are covered by Talos Snort SIDs 57403, 57404, 57411, and 57414.
  • ·The nuclei template XOR-encodes the cookie value using a per-request epoch timestamp and date, meaning the forged X-BackEndCookie will differ on every exploitation attempt — static byte-matching on the cookie value alone is insufficient for detection.
  • ·Microsoft's advisory notes exploit status as 'Publicly Disclosed: No; Exploited: No' at time of publication, but rates exploitation likelihood as 'More Likely' for both latest and older software releases.
  • ·The Snort SIDs (57403, 57404, 57411, 57414) cover all four April 2021 Exchange RCE CVEs collectively, not exclusively CVE-2021-28481.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.