PT-2021-4641 · Microsoft · Exchange Server

Feng Dong + 3 · Published 2021-11-09 · Updated 2026-01-16 · CVE-2021-42321

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2013 through 2019

Description The issue is related to a remote code execution vulnerability in Microsoft Exchange Server, caused by insufficient validation of commandlet arguments. This allows a remote attacker to execute arbitrary code. There have been limited targeted attacks using this vulnerability in the wild. The vulnerability exists due to issues with the validation of cmdlet arguments, and exploitation requires authentication to a vulnerable Exchange Server.

Recommendations For Microsoft Exchange Server versions 2013 through 2019, update to a version that includes the security updates released in November 2021 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable cmdlet arguments until a patch is available. Restrict access to the Exchange Server to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-05330

CVE-2021-42321

Affected Products

Exchange Server

References · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_chainedserializationbinder_denylist_typo_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb · Exploit
• 🔥 https://github.com/DarkSprings/CVE-2021-42321 · Exploit
• 🔥 https://github.com/7BitsTeam/exch_CVE-2021-42321 · Exploit
• 🔥 http://packetstormsecurity.com/files/168131/Microsoft-Exchange-Server-ChainedSerializationBinder-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/166153/Microsoft-Exchange-Server-Remote-Code-Execution.html · Exploit
• https://bdu.fstec.ru/vul/2021-05330 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42321 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42321 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321 · Security Note
• https://t.me/ckure/10475 · Telegram Post
• https://t.me/poxek/1941 · Telegram Post