Two Exchange bugs that, chained, became the year's worst email-server exploit.
The '1 + 1 = 3' Effect. The file-write bug alone has little exploit potential, it still needs proper access rights. The SSRF alone is 'just' an info-disclosure. Chained, they become unauthenticated RCE against internet-facing Exchange, one of the most impactful Exchange vulnerabilities ever disclosed.
Step-by-step exploitation flow. Each link compounds the next.
Lets an unauthenticated attacker send crafted requests that bypass authentication and impersonate the Exchange server itself.
Yielded Result: Authenticated-equivalent access to Exchange as the server identity.
Allows an authenticated session to write attacker-controlled files to arbitrary paths on the Exchange host.
Yielded Result: Persistent web shell on the Exchange server, enabling full RCE.
Unauthenticated Remote Code Execution and mass mailbox collection across internet-facing Exchange.