Security News > 2021 > August > Microsoft Exchange ProxyToken bug can let hackers steal user email
Technical details have emerged on a serious vulnerability in Microsoft Exchange Server dubbed ProxyToken that does not require authentication to access emails from a target account.
An attacker can exploit the vulnerability by crafting a request to web services within the Exchange Control Panel application and steal messages from a victim's inbox.
Tracked as CVE-2021-33766, ProxyToken gives unauthenticated attackers access to the configuration options of user mailboxes, where they can define an email forwarding rule.
In Microsoft Exchange deployments where the "Delegated Authentication" feature is active, the frontend forwards the requests that need authentication to the backend, which identifies them by the presence of a 'SecurityToken' cookie.
The default configuration of Microsoft Exchange does not load for the backend ECP site the module responsible for delegating the validation process.
As in the case of ProxyShell vulnerabilities, if administrators of Microsoft Exchange servers have not installed the patches for ProxyToken, they should prioritize the task.
News URL
Related news
- Microsoft fixes Exchange Online bug flagging Gmail emails as spam (source)
- Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware (source)
- Microsoft Credits EncryptHub, Hacker Behind 618+ Breaches, for Disclosing Windows Flaws (source)
- Microsoft investigates global Exchange Admin Center outage (source)
- Microsoft: Exchange 2016 and 2019 reach end of support in six months (source)
- Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp (source)
- Microsoft fixes machine learning bug flagging Adobe emails as spam (source)
- Hackers abuse OAuth 2.0 workflows to hijack Microsoft 365 accounts (source)
- US indicts Black Kingdom ransomware admin for Microsoft Exchange attacks (source)
- Hackers exploit VMware ESXi, Microsoft SharePoint zero-days at Pwn2Own (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-07-14 | CVE-2021-33766 | Unspecified vulnerability in Microsoft Exchange Server 2013/2016/2019 Microsoft Exchange Server Information Disclosure Vulnerability | 0.0 |