[{"title":"Microsoft Exchange Proxyshell Remote Code Execution Vulnerability Exploit","body":"This module uses a path confusion that leads to an authentication bypass (ACL) which allows unauthenticated access to an arbitrary backend URL. Then an elevation of privilege present in CommonAccessTokenFromUrl of RemotePowershellBackendCmdletProxyModule.cs is used to execute Exchange powershell commands as Exchange Administrator. Finally, an arbitrary file write present in the New-MailboxExportRequest Exchange powershell command is used to write a webshell in the system file. The deployed agent will run with the SYSTEM privileges.","created":"\u003Ctime datetime=\u00222021-10-29T00:00:00-05:00\u0022 class=\u0022datetime\u0022\u003EOctober 29, 2021\u003C\/time\u003E\n","field_cve_link":"\u003Ca href=\u0022https:\/\/www.cve.org\/CVERecord?id=CVE-2021-34473\u0022 target=\u0022_blank\u0022\u003ECVE-2021-34473\u003C\/a\u003E, \u003Ca href=\u0022https:\/\/www.cve.org\/CVERecord?id=CVE-2021-31207\u0022 target=\u0022_blank\u0022\u003ECVE-2021-31207\u003C\/a\u003E, \u003Ca href=\u0022https:\/\/www.cve.org\/CVERecord?id=CVE-2021-34523\u0022 target=\u0022_blank\u0022\u003ECVE-2021-34523\u003C\/a\u003E","field_exploit_platform":"Windows","field_exploit_type":"Exploits \/ Remote Code Execution","field_product_name":"Impact"}]