{"uuid": "99232470-7bf9-47f4-9bb5-5a6804f289f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb", "content": "{\"aliases\": [\"exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce\"], \"arch\": \"cmd, x86, x64\", \"author\": [\"pwnforsp\", \"zcgonvh\", \"Microsoft Threat Intelligence Center\", \"Microsoft Security Response Center\", \"peterjson\", \"testanull\", \"Grant Willcox\", \"Spencer McIntyre\", \"Markus Wulftange\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities within the ChainedSerializationBinder as used in\\n          Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and\\n          Exchange Server 2016 CU22 all prior to Mar22SU.\\n\\n          Note that authentication is required to exploit these vulnerabilities.\", \"disclosure_date\": \"2021-12-09\", \"fullname\": \"exploit/windows/http/exchange_chainedserializationbinder_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Microsoft Exchange Server ChainedSerializationBinder RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb\", \"platform\": \"Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"windows/http/exchange_chainedserializationbinder_rce\", \"references\": [\"CVE-2021-42321\", \"URL-https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321\", \"URL-https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7\", \"URL-https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169\", \"URL-https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\", \"URL-https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852\", \"CVE-2022-23277\", \"URL-https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html\", \"URL-https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows Command\", \"Windows Dropper\", \"PowerShell Stager\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:46.653338Z"}