Improper Authentication in Microsoft Exchange Server - CVE-2021-33766

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to the application.

The vulnerability was dubbed ProxyToken.

Affected software

How to mitigate CVE-2021-33766

Links to Public Exploits and PoC-codes

• Exploit #6755 - CVE-2021-33766-ProxyToken (CVE-2021-33766-poc) (September 15, 2021)
• Exploit #6679 - CVE-2021-33766-ProxyToken (ProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server POC exploit) (September 1, 2021)

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33766
• https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server

Related Security Bulletins

• Information disclosure in Microsoft Exchange