cbcvebase.
CVE-2021-42321
published 2021-11-10

CVE-2021-42321: Microsoft Exchange Server Remote Code Execution Vulnerability

PriorityP197high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2021-12-01
Exploited in the wild
EPSS
90.39%
99.8th percentile
Microsoft Exchange Server Remote Code Execution Vulnerability

Affected

10 ranges
VendorProductVersion rangeFixed in
microsoftexchange_server
microsoftexchange_server
microsoftmicrosoft_exchange_server_2016_cumulative_update_21>= 15.01.0 < 15.01.2308.02015.01.2308.020
microsoftmicrosoft_exchange_server_2016_cumulative_update_22>= 15.0.0 < 15.01.2375.01715.01.2375.017
microsoftmicrosoft_exchange_server_2019_cumulative_update_10>= 15.02.0 < 15.02.0792.01915.02.0792.019
microsoftmicrosoft_exchange_server_2019_cumulative_update_11>= 15.02.0 < 15.02.0986.01415.02.0986.014
msrcmicrosoft_exchange_server_2016_cumulative_update_21
msrcmicrosoft_exchange_server_2016_cumulative_update_22
msrcmicrosoft_exchange_server_2019_cumulative_update_10
msrcmicrosoft_exchange_server_2019_cumulative_update_11

Detection & IOCsextracted from sources · hover to see the quote

url/ews/exchange.asmx
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Delete User Configuration - xbit set 1 (CVE-2021-42321)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ews/exchange.asmx"; fast_pattern; http.request_body; content:""; content:"|3a|DeleteUserConfiguration>"; xbits:set,ET.2021.42321.1,track ip_src,expire 30; noalert; reference:cve,2021-42321; classtype:attempted-admin; sid:2034519; rev:1;)
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange Server Remote Code Execution Inbound (CVE-2021-42321)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ews/exchange.asmx"; fast_pattern; http.request_body; content:""; content:"|3a|GetClientAccessToken>"; content:"|3a|TokenRequests>"; xbits:isset,ET.2021.42321.2,track ip_src,expire 30; xbits:unset,ET.2021.42321.2,track ip_src,expire 30; reference:cve,2021-42321; classtype:attempted-admin; sid:2034521; rev:1;)
bytes
|3a|DeleteUserConfiguration>
bytes
|3a|GetClientAccessToken>
bytes
|3a|TokenRequests>
  • Exploit traffic targets the Exchange Web Services (EWS) endpoint via HTTP POST to /ews/exchange.asmx. Monitor for POST requests to this URI containing serialized DeleteUserConfiguration or GetClientAccessToken SOAP actions, which are indicative of ChainedSerializationBinder exploitation.
  • The vulnerability is exploited through improper validation in cmdlet arguments (ChainedSerializationBinder) within Microsoft Exchange. Authenticated attacker context is required — correlate suspicious EWS activity with authenticated sessions.
  • Affected versions are Exchange Server 2019 CU10, CU11, Exchange Server 2016 CU21, and CU22, all prior to Mar22SU. Scope detection to these specific builds.
  • The Metasploit module is named 'exchange_chainedserializationbinder_rce' — use this as a hunt term in endpoint/EDR telemetry and network proxy logs for known exploit framework activity.
  • Exploitation has been confirmed in the wild against both latest and older software releases. Treat any POST to /ews/exchange.asmx with serialization-related body content as high-priority alert.
  • ·Exploitation requires prior authentication (low-privilege authenticated user). Unauthenticated traffic to /ews/exchange.asmx matching these signatures should still be alerted but may indicate scanning rather than active exploitation.
  • ·The second Snort rule (sid:2034521) is marked confidence Medium and uses xbits state tracking — it requires the first rule (sid:2034519) to have fired for the same source IP within 30 seconds. Deploy both rules together for full detection chain coverage.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.