Loading vulnerability…
Microsoft Exchange Server Post-Authentication Deserialization RCE
CVE-2021-42321 is a post-authentication remote code execution vulnerability in Microsoft Exchange Server. Reported affected releases include Exchange 2016 CU21/CU22 and Exchange 2019 CU10/CU11. The vulnerable deserialization path involves TypedBinaryFormatter failing to pass its serialization binder correctly and ineffective type restrictions in ChainedSerializationBinder. Deserialization of ClaimsPrincipal can consequently invoke an unfiltered BinaryFormatter deserialization operation. An authenticated attacker can place a serialized gadget chain in the BinaryData field through the Exchange Web Services CreateUserConfiguration operation and trigger deserialization through GetClientAccessToken. Successful exploitation executes attacker-controlled code on the server. Exploitation in the wild and publicly available proof-of-concept code have been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated remote attacker to execute arbitrary code on an affected Exchange Server. The vulnerability has been used as a network-access vector by Hive ransomware actors. The execution privilege level and specific confidentiality or availability consequences are not established.
If you can’t patch tonight, do this now.
Because this is a post-authentication flaw, reduce exposure by tightly restricting who can authenticate to Exchange and who can access Exchange Web Services, especially from untrusted networks. Limit administrative and service account access, enforce multifactor authentication where applicable, segment Exchange from unnecessary network paths, and monitor for suspicious EWS activity involving user configuration operations and anomalous token-related requests. If immediate patching is not possible, minimize external exposure of vulnerable Exchange services and apply compensating access controls until updates can be deployed.
Patch, then assume compromise.
Apply the vendor-provided Microsoft Exchange Server security update addressing CVE-2021-42321.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.