A security researcher has released proof-of-concept (PoC) exploit code for a recently patched code execution vulnerability affecting on-prem Microsoft Exchange Server installations.
Tracked as CVE-2021-42321 (CVSS 8.8), the security defect was addressed with the November 2021 Patch Tuesday set of updates, when Microsoft warned that it was already being exploited in “limited targeted attacks in the wild.”
Affecting on-premises Microsoft Exchange Server, including Exchange Hybrid mode instances, the bug is described as a post-authentication flaw that affects Exchange 2016 and 2019.
An authenticated attacker, Microsoft said, could exploit the security hole to execute code remotely on vulnerable systems.
Less than two weeks after the Redmond-based tech giant detailed the flaw, a security researcher going by the online handle of Janggggg announced the release of PoC exploit code targeting the vulnerability.
The code was designed to launch mspaint.exe on the target system and an be used “to recognize the signature pattern of a successful attack event,” the researcherr said.
On November 9, Microsoft encouraged administrators to install the newly released patches immediately, to prevent exploitation and the release of the PoC code should be a wakeup call for all those who use a vulnerable Exchange Server variant and haven’t applied the update yet.
Related: Zero-Days Under Attack: Microsoft Plugs Exchange Server, Excel Holes
Related: Researchers Release PoC Tool Targeting BrakTooth Bluetooth Vulnerabilities