Exchange Server Zero-Day Exploits: HAFNIUM
Information about the HAFNIUM attacks targeting on-premises Exchange Server and the associated March 2021 security updates.
Historical security notice: This post was originally published on March 7, 2021. The vulnerabilities and mitigation guidance described here relate to the 2021 HAFNIUM attacks. Use current Microsoft security guidance and supported Exchange Server versions when responding to similar security issues today.
On March 2, 2021, Microsoft released several security updates for on-premises Microsoft Exchange Server. The updates addressed vulnerabilities that were being actively exploited against on-premises Exchange Server deployments.
Microsoft classified the vulnerabilities as critical and recommended updating affected Exchange Server installations as soon as possible.
The affected versions were:
- Microsoft Exchange Server 2013.
- Microsoft Exchange Server 2016.
- Microsoft Exchange Server 2019.
Note: Exchange Online was not affected by these vulnerabilities. Microsoft Exchange Server 2010 also received an update for defense-in-depth purposes.
Attack Chain
The vulnerabilities were used together as part of an attack chain. The initial attack required the ability to establish an untrusted connection to the Exchange Server on TCP port 443.
The exploited vulnerabilities were:
CVE-2021-26855
CVE-2021-26855 was a server-side request forgery (SSRF) vulnerability in Exchange Server.
An attacker could use this vulnerability to send arbitrary HTTP requests and authenticate as the Exchange Server.
CVE-2021-26857
CVE-2021-26857 was an insecure deserialization vulnerability in the Unified Messaging service.
Insecure deserialization occurs when untrusted, user-controlled data is deserialized by an application without sufficient validation. Exploiting this vulnerability could allow HAFNIUM to execute code as SYSTEM on the Exchange Server.
Exploitation required administrator permission or another vulnerability in the attack chain.
CVE-2021-26858
CVE-2021-26858 was a post-authentication arbitrary file-write vulnerability in Exchange Server.
After authenticating to the Exchange Server, an attacker could use this vulnerability to write a file to an arbitrary path on the server.
Authentication could be obtained by exploiting CVE-2021-26855 or by compromising the credentials of a legitimate administrator.
CVE-2021-27065
CVE-2021-27065 was another post-authentication arbitrary file-write vulnerability in Exchange Server.
As with CVE-2021-26858, an attacker who authenticated to the Exchange Server could write a file to an arbitrary path.
The attacker could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by obtaining valid administrator credentials.
Security Updates
Security updates were available for the following Exchange Server versions and cumulative update levels:
- Exchange Server 2010: The update required Service Pack 3 or any Service Pack 3 Rollup Update. This was a defense-in-depth update. See the Exchange Server 2010 security update.
- Exchange Server 2013: The update required cumulative update 23. See the Exchange Server 2019, 2016, and 2013 security update.
- Exchange Server 2016: The update required cumulative update 19 or cumulative update 18. See the Exchange Server 2019, 2016, and 2013 security update.
- Exchange Server 2019: The update required cumulative update 8 or cumulative update 7. See the Exchange Server 2019, 2016, and 2013 security update.
- Security updates for older cumulative updates.
Update #4 — 16.03.2021
Microsoft released the One-Click Microsoft Exchange On-Premises Mitigation Tool.
Microsoft also published guidance for investigating and remediating on-premises Exchange Server vulnerabilities.
The mitigation tool was designed as an interim measure for customers who had not yet installed the security updates. It:
- Applied a URL Rewrite mitigation for CVE-2021-26855.
- Scanned the Exchange Server using Microsoft Safety Scanner.
- Attempted to reverse changes made by identified threats.
Important: The mitigation tool was not a replacement for installing the Exchange Server security updates. It was intended as a temporary measure until the servers could be fully updated.
Update #3 — 09.03.2021
Microsoft released security updates for older cumulative updates.
Microsoft also provided a script that could check Exchange Server log files for indicators of compromise and compare Exchange binary hashes. The script supported Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019.
Update #2 — 07.03.2021
As a temporary workaround, Microsoft published mitigation guidance for the Exchange Server vulnerabilities.
Microsoft strongly recommended upgrading on-premises Exchange Server deployments to the latest supported version and installing the applicable security updates as soon as possible.
Update #1 — 06.03.2021
Microsoft released an updated script to scan Exchange Server log files for indicators of compromise:
Check for CVE-2021-26855
The http-vuln-cve2021-26855.nse script is an Nmap script that checks whether a specified URL may be vulnerable to the Exchange Server SSRF vulnerability CVE-2021-26855.
Download the latest version from the Microsoft CSS-Exchange releases page.
Run the script with Nmap:
1
nmap --script http-vuln-cve2021-26855.nse exchange.server.url
Replace exchange.server.url with the hostname of the Exchange Server you want to test.
Warning: A vulnerability scan is not a substitute for patching or a complete compromise assessment. If the server was exposed to the internet during the exploitation window, investigate it using Microsoft’s incident-response guidance even if the server is now patched.
Exchange Server vulnerability detection.
Recommended Response
For an on-premises Exchange Server that may have been exposed:
- Install the security update that matches the installed Exchange Server version and cumulative update.
- Apply Microsoft’s temporary mitigation if immediate patching is not possible.
- Review Exchange, IIS, and Windows event logs for suspicious activity.
- Run Microsoft’s Exchange security scripts and Microsoft Safety Scanner.
- Investigate suspicious web shells, newly created files, administrator accounts, and unusual authentication activity.
- Rotate credentials if compromise is suspected.
- Review internet-facing access to Exchange Server, especially TCP port
443. - Remove temporary mitigations after patching only after validating that the server is protected.