cbcvebase.
CVE-2021-28482
published 2021-04-13

CVE-2021-28482: Microsoft Exchange Server Remote Code Execution Vulnerability

PriorityP192high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
83.21%
99.6th percentile
Microsoft Exchange Server Remote Code Execution Vulnerability

Affected

13 ranges
VendorProductVersion rangeFixed in
microsoftexchange_server
microsoftexchange_server
microsoftexchange_server
microsoftmicrosoft_exchange_server_2013_cumulative_update_23>= 15.00.0 < 15.00.1497.01515.00.1497.015
microsoftmicrosoft_exchange_server_2016_cumulative_update_19>= 15.01.0 < 15.01.2176.01215.01.2176.012
microsoftmicrosoft_exchange_server_2016_cumulative_update_20>= 15.01.0 < 15.01.2242.00815.01.2242.008
microsoftmicrosoft_exchange_server_2019_cumulative_update_8>= 15.02.0 < 15.02.0792.01315.02.0792.013
microsoftmicrosoft_exchange_server_2019_cumulative_update_9>= 15.02.0 < 15.02.0858.01015.02.0858.010
msrcmicrosoft_exchange_server_2013_cumulative_update_23
msrcmicrosoft_exchange_server_2016_cumulative_update_19
msrcmicrosoft_exchange_server_2016_cumulative_update_20
msrcmicrosoft_exchange_server_2019_cumulative_update_8
msrcmicrosoft_exchange_server_2019_cumulative_update_9

Detection & IOCsextracted from sources · hover to see the quote

path/ews/Exchange.asmx
path/ews/wssecurity
cookieX-BackEndCookie={{email}}={{base64(hex_decode(rawXor))}}
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange RCE Setup Inbound (CVE-2021-28482)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ews/Exchange.asmx"; http.request_body; content:"ProposeOptionsMeeting"; content:""|3b|>|3b|cmd"; distance:0; fast_pattern; content:"Value>|3b|"; distance:0; reference:cve,2021-28482; classtype:attempted-admin; sid:2032897; rev:1; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2021_05_04, cve CVE_2021_28482, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_23;)
snort
57403, 57404, 57411, 57414
  • Exploit traffic targets POST requests to /ews/Exchange.asmx containing 'ProposeOptionsMeeting' in the body along with a semicolon-delimited cmd injection pattern (|3b|>|3b|cmd) in a Value element.
  • Exploit probe begins with a GET /owa/ request; the server's X-FEServer response header is extracted and used to craft the subsequent malicious POST, so anomalous X-FEServer header usage in follow-on EWS requests is a signal.
  • The exploit sets a crafted X-BackEndCookie and X-AnchorMailbox header on the POST to /ews/wssecurity; presence of these headers on unauthenticated EWS requests is suspicious.
  • A successful exploit response includes both 'X-Calculatedbetarget' and 'X-Owa-Error' headers with HTTP 302, and body containing '/owa/auth/errorFE.aspx'.
  • ·The Nuclei template in DOC 4 is labelled CVE-2021-28481 (ProxyNotFound/SSRF) but is referenced alongside CVE-2021-28482 deserialization research; the /ews/wssecurity path and cookie-crafting logic apply to the SSRF pre-auth chain, not exclusively to CVE-2021-28482 RCE.
  • ·Microsoft's advisory states exploit status as 'Publicly Disclosed: No; Exploited: No' at time of publication, but rates exploitation likelihood as 'More Likely' for both latest and older software releases.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.