CVE-2021-42321

HIGHCISA KEVRansomware

Microsoft Exchange Server Remote Code Execution Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-42321 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit and 2 repository PoCs. CISA lists CVE-2021-42321 in KEV and reports its use in known ransomware campaigns.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Description source: GitHub Advisory

Exploitation context

Known exploitation

CISA KEV
Listed · Nov 17, 2021 · CISA
VulnCheck KEV
Listed · Nov 9, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · CISA

Available material

Catalogued exploits
1
Repository PoCs
2

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 3, 2024 · Source: CVE List

Affected products and versions

6
ProductSourceVersion range

Exchange

Browse Microsoft / Exchange
CISAVersion data not supplied

Exchange Server

Browse Microsoft / Exchange Server
VulnCheckVersion data not supplied

Microsoft Exchange Server 2016 Cumulative Update 21

Browse Microsoft / Microsoft Exchange Server 2016 Cumulative Update 21
CVE List15.01.0 to < 15.01.2308.020affected

Microsoft Exchange Server 2016 Cumulative Update 22

Browse Microsoft / Microsoft Exchange Server 2016 Cumulative Update 22
CVE List15.0.0 to < 15.01.2375.017affected

Microsoft Exchange Server 2019 Cumulative Update 10

Browse Microsoft / Microsoft Exchange Server 2019 Cumulative Update 10
CVE List15.02.0 to < 15.02.0792.019affected

Microsoft Exchange Server 2019 Cumulative Update 11

Browse Microsoft / Microsoft Exchange Server 2019 Cumulative Update 11
CVE List15.02.0 to < 15.02.0986.014affected

Proofs of concept

3

Catalogued exploits

MetasploitMicrosoft Exchange Server ChainedSerializationBinder RCEMetasploit exploitby Grant Willcox +8 moreNot analyzed1 file

Ruby · linked to 2 vulnerabilities

Metasploit
PoC details

Repository PoCs

GitHubDarkSprings/CVE-2021-42321Repository PoCby DarkSprings83Not analyzed2 files

8.0 KiB

GitHub
PoC details
GitHub7BitsTeam/exch_CVE-2021-42321Repository PoCby 7BitsTeam10Not analyzed3 files

41.5 KiB

GitHub
PoC details

References

5