CVE-2021-26855

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description Microsoft Exchange Server contains a flaw that allows remote attackers to execute arbitrary code. The issue is related to insufficient validation of incoming requests, enabling a Server-Side Request Forgery (SSRF) attack via specially crafted HTTPS requests. These requests utilize malicious X-AnonResource-Backend and distorted X-BEResource cookies to authenticate on the server. Real-world exploitation has been observed in campaigns targeting diplomatic organizations in Indonesia, government entities in Taiwan, and software developers across various countries including Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. In these incidents, the flaw was used to gain initial access and deploy the SharkLoader loader to install Cobalt Strike Beacon on compromised systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.