{"uuid": "cbbdb0cd-22d1-49bd-bb57-ce01e1d881ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/hacking_Attack/30807", "content": "Black Hat Ethical Hacking\nMicrosoft urges Exchange admins to patch bug exploited in the wild\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft urges Exchange admins to patch bug exploited in the wildPost Views: 222 \nReading Time: 1 Minute\nMicrosoft warned admins today to immediately a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.\nThe security flaw tracked as CVE-2021-42321\u00a0impacts Exchange Server 2016 and Exchange Server 2019, and it is caused by improper validation of cmdlet arguments according to Redmond\u2019s security advisory.\n\nCVE-2021-42321 only affects on-premises Microsoft Exchange servers, including those used by customers in Exchange Hybrid mode (Exchange Online customers are protected against exploitation attempts and don\u2019t need to take any further action).\n\n\u201cWe are aware of limited targeted attacks in the wild using one of the vulnerabilities (CVE-2021-42321), which is a post-authentication\u00a0vulnerability in Exchange 2016 and 2019,\u201d Microsoft explained.\n\n\u201cOur recommendation is to install these updates immediately\u00a0to protect your environment.\u201d\n\nFor a quick inventory of all Exchange servers in your environment behind on updates (CUs and SUs), you can use the latest version of the Exchange Server Health Checker script.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Exchange_Server_update_paths.jpg \n<figcaptionExchange Server update paths (Microsoft) \nSee Also: Complete Offensive Security and Ethical Hacking Course\nIf you want to check and see if any of your Exchange servers were hit by CVE-2021-42321 exploitation attempts, you have to run the following PowerShell query on each Exchange server to check for specific events in the Event Log: Get-EventLog -LogName Application -Source \"MSExchange Common\" -EntryType Error | Where-Object { $_.Message -like \"*BinaryFormatter.Deserialize*\"} \nIn September, Microsoft has added a new Exchange Server feature named Microsoft Exchange Emergency Mitigation (EM) that provides automated protection for vulnerable Exchange servers.\n\nIt does that by automatically applying interim mitigations for high-risk security bugs to secure on-premises servers against incoming attacks and give admins additional time to apply security updates.\n\nWhile Redmond said\u00a0that it would use this new feature to mitigate actively exploited flaws like CVE-2021-42321, today\u2019s advisory\u00a0and the blog post\u00a0regarding this month\u2019s Exchange Server security updates don\u2019t include any mentions of Exchange EM being put to use.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability On-premises Exchange servers under attackSince the start of 2021, Exchange admins have dealt with two massive waves of attacks targeting the ProxyLogon and ProxyShell vulnerabilities.\n\nStarting with early March, multiple state-backed and financially motivated threat actors used\u00a0ProxyLogon exploits\u00a0to\u00a0deploy\u00a0web shells, cryptominers, ransomware, and other malware while\u00a0targeting over a quarter of a million Microsoft Exchange servers, belonging to tens of thousands of organizations worldwide.\n\nFour months later, US and allies, including the European Union, the United Kingdom, and NATO, officially blamed China\u00a0for this widespread Microsoft Exchange hacking campaign.\n\nIn August, attackers also\u00a0began scanning for\u00a0and hacking Exchange servers\u00a0using the ProxyShell vulnerabilities after security researchers managed to reproduce\u00a0a working exploit.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer While, in the beginning, payloads dropped on Exchange servers exploited [...]", "creation_timestamp": "2026-09-08T00:00:58.367388Z"}