Back to Vulnerability Database
    criticalAC-PROXYSHELL· 12 exploit paths

    ProxyShell: Pre-Auth to SYSTEM on Microsoft Exchange

    Three Exchange flaws chain into unauthenticated RCE with SYSTEM privileges.

    CVE-2021-34473→
    CVE-2021-34523→
    CVE-2021-31207
    THE PRIMARY LESSON:

    The 'Medium' Severity Trap. The final link (CVE-2021-31207) is rated only CVSS 6.6 (Medium) in isolation. A defender filtering logs solely by 'High/Critical' would ignore it, yet it acts as the payload delivery vehicle that awards full SYSTEM privileges.

    Chain Visualization

    Step-by-step exploitation flow. Each link compounds the next.

    1
    CVE-2021-34473Critical (CVSS 9.8)T1190 – Exploit Public-Facing Application

    Pre-Auth Path Confusion

    Exploits explicit path parsing discrepancies to bypass access control lists (ACLs) entirely.

    Securin Risk: 9.6CVSS: 9.8Discovered: Jul 13, 2021

    Yielded Result: Unauthenticated access to the Exchange PowerShell backend interface.

    2
    CVE-2021-34523Critical (CVSS 9.8)T1068 – Exploitation for Privilege Escalation

    PowerShell Backend Elevation

    Allows an authenticated user (now bypassed) to elevate their privileges inside the Exchange PowerShell execution context.

    Securin Risk: 9.4CVSS: 9.8Discovered: Jul 13, 2021

    Yielded Result: Exchange Admin (SYSTEM) code execution authority.

    3
    CVE-2021-31207Medium (CVSS 6.6)T1505.003 – Web Shell

    Arbitrary File Write

    Allows the authenticated/elevated session to write malicious payload files anywhere on the operating system.

    Securin Risk: 8.9CVSS: 6.6Discovered: May 11, 2021

    Yielded Result: Web shell installation leading to persistent, unauthenticated SYSTEM RCE.

    ULTIMATE THREAT ACTION OUTCOME

    Unauthenticated Remote Code Execution (RCE) with SYSTEM privileges on internal mail servers.

    Remediation Urgency: Immediate Patching & Web Shell AuditsActive Exploits in the Wild

    THREAT PROFILE

    Primary Target
    On-Premises Microsoft Exchange
    Threat Actor Focus
    Ransomware groups, State-sponsored APTs
    Era / Impact Timeline
    Released 2021 (Remains heavily targeted today)

    MITRE ATT&CK MAPPING

    Enterprise Map
    1. Initial Access
      T1190 – Exploit Public-Facing Application
      Access path confusion via Exchange AutoDiscover port.
    2. Privilege Escalation
      T1068 – Exploitation for Privilege Escalation
      Command hijacking on the PowerShell backend.
    3. Persistence & Execution
      T1505.003 – Web Shell
      Writing web shells to IIS virtual directories.
    4. Impact
      T1486 – Data Encrypted for Impact
      Ransomware payload deployment following complete host takeover.

    Explore other attack chains

    AC-PROXYLOGON
    ProxyLogon
    Two Exchange bugs that, chained, became the year's worst email-server exploit.
    AC-IVANTI-2024
    Ivanti Connect Around
    An SSL-VPN appliance chain turning two bugs into perimeter RCE.