PT-2021-3815 · Microsoft · Exchange Server

Orangetw · Published 2021-07-13 · Updated 2026-07-07 · CVE-2021-34473

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description An issue exists in Microsoft Exchange Server related to code generation management errors. This flaw allows a remote attacker to execute arbitrary code and impact the system. In real-world incidents, this was part of a campaign targeting the Omani government, where attackers used ProxyShell exploits to compromise mail servers and gain persistent access via custom web shells to exfiltrate sensitive data from multiple ministries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SSRF

Code Injection

Weakness Enumeration

CWE-918

CWE-94

Related Identifiers

BDU:2021-04125

CVE-2021-34473

ZDI-21-821

Affected Products

Exchange Server

References · 127

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb · Exploit
• 🔥 https://github.com/horizon3ai/proxyshell · Exploit
• 🔥 https://github.com/cyberheartmi9/Proxyshell-Scanner · Exploit
• 🔥 https://github.com/kh4sh3i/ProxyShell · Exploit
• 🔥 https://github.com/phamphuqui1998/CVE-2021-34473 · Exploit
• 🔥 https://github.com/p2-98/CVE-2021-34473 · Exploit
• 🔥 https://github.com/je6k/CVE-2021-34473-Exchange-ProxyShell · Exploit
• 🔥 https://github.com/RaouzRouik/CVE-2021-34473-scanner · Exploit
• 🔥 http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/667108 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34473 · Security Note
• https://bdu.fstec.ru/vul/2021-04125 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-821 · Security Note