CVE DatabaseCVE-2021-34473

Updated 2026-08-10한국어 권고문 →

CVE-2021-344739.1/CRITICALCISA KEVCWE-918CWE-918

Microsoft Exchange Server ProxyShell Remote Code Execution Vulnerability (CVE-2021-34473) Technical Advisory

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

exchange_server

Published Date

2021-07-14

CVSS v3.1

9.1

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Microsoft Exchange Server 2013, 2016, and 2019 on-premises deployments

Impact

Unauthenticated attackers can bypass security controls to execute arbitrary PowerShell commands with SYSTEM privileges

Mitigation

Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange management ports

Affected Products & Version Scope

Microsoft Exchange Server 2013, 2016, and 2019 on-premises installations lacking the KB5001779 security update

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is to apply the latest Cumulative Update (CU) and Security Update (SU) provided by Microsoft. Use the following PowerShell commands to verify your current Exchange version and apply the necessary updates.

powershell

# Check the current Exchange Server version and build number
Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion

# Restart IIS and Exchange services after applying the official security patch
Restart-Service W3SVC, MSExchangeIS -Force

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, use the IIS URL Rewrite module to block external access to the vulnerable Autodiscover JSON endpoint.

powershell

# Import WebAdministration module and configure IIS URL Rewrite rule to block ProxyShell patterns
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter 'system.webServer/rewrite/rules' -Name '.' -Value @{name='Block_ProxyShell'; patternSyntax='ECMAScript'; stopProcessing='True'}
Add-WebConfigurationProperty -Filter "system.webServer/rewrite/rules/rule[@name='Block_ProxyShell']/match" -Name 'url' -Value '.*autodiscover\.json.*'
Add-WebConfigurationProperty -Filter "system.webServer/rewrite/rules/rule[@name='Block_ProxyShell']/conditions" -Name '.' -Value @{input='{REQUEST_URI}'; pattern='.*autodiscover\.json.*'}
Add-WebConfigurationProperty -Filter "system.webServer/rewrite/rules/rule[@name='Block_ProxyShell']/action" -Name '.' -Value @{type='CustomResponse'; statusCode=403; subStatusCode=0; statusReason='Forbidden'; statusDescription='Blocked by Security Policy'}

3. Log Audit & IoC Verification Commands

Inspect IIS access logs to identify potential exploitation attempts targeting the Autodiscover and PowerShell endpoints.

powershell

# Search IIS logs for suspicious requests containing autodiscover.json and powershell keywords
Get-ChildItem -Path 'C:\inetpub\logs\LogFiles\W3SVC1\' -Filter '*.log' |
    Select-String -Pattern 'autodiscover.json.*powershell' |
    Select-Object -Property Line -First 50

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation of the ProxyShell vulnerability in the wild, immediate patching of all internet-facing Exchange Servers is highly recommended.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability is a Server-Side Request Forgery (SSRF, CWE-918) residing in the communication mechanism between the Client Access Service (CAS) frontend and the backend services of Microsoft Exchange Server. The root cause lies in the improper validation of input URLs during the routing process. When the frontend parses specific URL paths, an attacker can craft a request that tricks the frontend into forwarding unauthorized requests to the backend API (such as the PowerShell endpoint) without proper authentication.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates the exploit by sending a specially crafted HTTP request to port 443 of an exposed Exchange Server. The request targets the Autodiscover service path, appending an Explicit Resource Locator (resembling an email address) followed by the backend API path. The frontend processes this request, strips or elevates the authentication context, and forwards it to the backend as an authenticated system request. This grants the attacker unauthenticated access to the backend PowerShell Remoting interface, allowing them to abuse mailbox import/export features to drop web shells and execute arbitrary system commands.

3. Infrastructure & Business Impact

As a core component of the notorious 'ProxyShell' exploit chain, this vulnerability is listed in the CISA KEV catalog and has been actively exploited by ransomware operators and APT groups worldwide. Successful exploitation allows complete compromise of the Exchange Server, leading to unauthorized access to sensitive corporate emails, data exfiltration, and potential lateral movement into the Active Directory (AD) domain controller, posing an existential threat to organizational infrastructure.

Official Vendor Advisories & References

NVD Original English Description

Microsoft Exchange Server Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473

Source: secure@microsoft.com · Patch, Vendor Advisory

http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-821/

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory, VDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-34473)

FAQ

Q1. How critical is CVE-2021-34473 and is it actively exploited in the wild?

CVE-2021-34473 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-34473?

Primary impacted vendors include microsoft across exchange_server. Scope summary: Microsoft Exchange Server 2013, 2016, and 2019 on-premises installations lacking the KB5001779 security update

Q3. What temporary mitigations or workarounds exist for CVE-2021-34473 before patching?

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange management ports Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION