PT-2021-3894 · Microsoft · Exchange Server

Le Xuan Tuyen · Published 2021-07-13 · Updated 2025-10-29 · CVE-2021-33766

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description The issue is an information disclosure affecting Microsoft Exchange Server. It involves an authentication bypass, specifically through a flaw related to delegated authentication and the handling of the SecurityToken cookie. An unauthenticated attacker can leverage this to gain access to mailbox configuration parameters, potentially altering email forwarding rules and modifying the Exchange Control Panel (ECP) configuration. This allows for the mirroring of email traffic and access to sensitive information. The vulnerability, known as ProxyToken, is based on a combination of the SecurityToken cookie and an HTTP 500 error containing a valid string. The issue could reveal personal information and sensitive company data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-04285

CVE-2021-33766

ZDI-21-798

Affected Products

Exchange Server

References · 28

• 🔥 https://github.com/bhdresh/CVE-2021-33766 · Exploit
• 🔥 https://github.com/bhdresh/CVE-2021-33766-ProxyToken · Exploit
• 🔥 https://github.com/demossl/CVE-2021-33766-ProxyToken · Exploit
• https://zerodayinitiative.com/advisories/ZDI-21-798 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33766 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33766 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33766 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33766 · Security Note
• https://bdu.fstec.ru/vul/2021-04285 · Security Note
• https://twitter.com/pdnuclei_bot/status/1977313334773928161 · Twitter Post
• https://t.me/cybersecuritytechnologies/4189 · Telegram Post
• https://t.me/freedomf0x/14335 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cibsecurity/28015 · Telegram Post