Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2023-21529)

1. Apply Official Security Patches

Refer to the Microsoft Security Update Guide for CVE-2023-21529 and install the appropriate Security Update (SU) or Cumulative Update (CU) for your specific Exchange Server version.

2. Temporary Mitigations (Prior to Patching)

If immediate patching is not feasible, implement the following workarounds:

• Restrict Remote PowerShell Access:

Disable Remote PowerShell for non-administrative users to minimize the attack surface.

  # Example: Disable Remote PowerShell for a specific user
  Set-User -Identity "username" -RemotePowerShellEnabled $false

• Network Segmentation and Access Control:

Restrict external access to the Exchange Admin Center (ECP) and PowerShell virtual directories. Ensure these endpoints are only accessible via trusted internal networks or secure VPNs.

• WAF and IPS Signature Deployment:

Configure Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS) to detect and block anomalous POST requests and serialized payloads targeting Exchange Web Services (EWS) and OWA endpoints.

CVE-2023-21529 is a critical Deserialization of Untrusted Data vulnerability (CWE-502) residing in Microsoft Exchange Server.

An attacker with standard user authentication (low-privileged credentials) can exploit this vulnerability by sending a specially crafted serialized object to the Exchange backend. When the server deserializes this untrusted input without proper validation, it triggers the execution of arbitrary code under the security context of the Exchange service (typically SYSTEM).

With a CVSS score of 8.8, this vulnerability is highly critical and has been actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. Threat actors, including ransomware groups like Storm-1175, have been observed targeting vulnerable internet-facing Exchange servers to gain initial access.