ProxyLogon (CVE-2021-26855)

ProxyLogon is a chain of bugs in on-premises Microsoft Exchange. CVE-2021-26855 is a server-side request forgery: an attacker with no account tricks Exchange into treating their request as a trusted internal one. Chained with CVE-2021-27065, a file-write bug, it lets them drop a web shell and run code on the server. The Taiwanese firm DEVCORE found it in December 2020 and reported it to Microsoft on 5 January 2021.

Attackers were already using it: Volexity saw exploitation from 3 January. Microsoft patched four zero-days on 2 March 2021, a week earlier than planned, and blamed a China-based group it calls Hafnium. By then the bugs were spreading to other groups (ESET counted at least ten), and on 8 March more than 125,000 Exchange servers were still unpatched. The European Banking Authority took its email systems offline after being hit.

Patching did not remove web shells that were already planted, so every exposed organisation also had to hunt for them and clean up. The lessons: internet-facing mail servers are prime targets, patch out of band when Microsoft does, and if a zero-day was in use before the fix, assume compromise and look for persistence.