Exchange vulnerability PoC released

Last month, on patch Tuesday, Microsoft released patches for four new remote code execution (RCE) vulnerabilities in Microsoft Exchange. At the time, details of the vulnerabilities were not available; however, this week security researcher Nguyen Jang released a technical write-up for CVE-2021-28482 along with proof-of-concept (PoC) exploit code written in Python. Jang gained some notoriety in March for being the first to post a PoC exploit for ProxyLogon, which Microsoft promptly had removed from GitHub.

CVE-2021-28482 is a post-authentication remote code execution vulnerability, which means it requires a user to log in before executing the code. It is a deserialization vulnerability in the Outlook Web Access (OWA) “MeetingPollHandler.ashx”. The PoC crafts a malicious meeting in OWA with a gadget chain generated from Serialization is the process of converting an object into a format that can be stored or transmitted over a network. For example, in Python (which is what I usually use), converting a Python list into a JSON file to be stored on disk. Deserialization is the opposite, so reading the JSON file and converting it back to a list. Deserialization vulnerabilities target the way the vulnerable app handles this deserialization process. When referencing deserialization vulnerabilities, a gadget is a term used to describe a class or the functions available within the current scope of the application.

Essentially, with CVE-2021-28482, an attacker crafts a meeting with a payload, but the attacker cannot call the malicious code directly. Instead, when MeetingPollHandler reads the XML that defines the meeting and begins processing the data, an attacker can use the gadget chain to reference a function within the current context that kicks off a chain of events that eventually leads to the payload being read executed. In Jang’s PoC it launches MSPaint.

Though these latest CVEs are all different than the ones related to Proxylogon, what we have seen is that the signatures Perch uses for detecting post-compromise activity will work just as well for CVE-2021-28482.

21 vulnerabilities patched in Exim

Exim is a widely used open-source mail transfer agent (MTA) for Unix-like operating systems. It’s the piece of software on many mail servers that handles getting your email from server A to server B, and it is the most widely used MTA by far. A recent code audit of Exim by Qualys revealed 21 exploitable vulnerabilities, collectively referred to as “21Nails.” Most of these vulnerabilities affect all versions of Exim. Ten can be exploited remotely and the other elven are local exploits.

These exploits can be chained together in multiple ways for an attacker to remotely exploit and gain full root access. This week, on Star Wars Day (May the Fourth be with you!), the Exim maintainers released new versions of Exim with patches for 21Nails. Below is a brief list:

CVE Description Type
CVE-2020-28007 Link attack in Exim’s log directory Local 
CVE-2020-28008 Assorted attacks in Exim’s spool directory Local 
CVE-2020-28014 Arbitrary file creation and clobbering Local 
CVE-2021-27216 Arbitrary file deletion Local 
CVE-2020-28011 Heap buffer overflow in queue_run() Local 
CVE-2020-28010 Heap out-of-bounds write in main() Local 
CVE-2020-28013 Heap buffer overflow in parse_fix_phrase() Local 
CVE-2020-28016 Heap out-of-bounds write in parse_fix_phrase() Local 
CVE-2020-28015 New-line injection into spool header file (local) Local 
CVE-2020-28012 Missing close-on-exec flag for privileged pipe Local 
CVE-2020-28009 Integer overflow in get_stdinput() Local 
CVE-2020-28017 Integer overflow in receive_add_recipient() Remote 
CVE-2020-28020 Integer overflow in receive_msg() Remote 
CVE-2020-28023 Out-of-bounds read in smtp_setup_msg() Remote 
CVE-2020-28021 New-line injection into spool header file (remote) Remote 
CVE-2020-28022 Heap out-of-bounds read and write in extract_option() Remote 
CVE-2020-28026 Line truncation and injection in spool_read_header() Remote 
CVE-2020-28019 Failure to reset function pointer after BDAT error Remote 
CVE-2020-28024 Heap buffer underflow in smtp_ungetc() Remote 
CVE-2020-28018 Use-after-free in tls-openssl.c Remote 
CVE-2020-28025 Heap out-of-bounds read in pdkim_finish_bodyhash() Remote 

All the above have been patched in the latest version of Exim, so if you are running Exim, it’s time to update to the latest version. You should consider any version before 4.94.2 obsolete going forward.

Our research team is looking into these 21 vulnerabilities and will be releasing detection content around them; however, best practice is to go ahead and update so you can sleep soundly.

Bryson Medlock, the Dungeon Master