MS.Exchange.Server.Autodiscover.Remote.Code.Execution

description-logoDescription

This indicates an attack attempt to exploit a Remote Code Execution in Microsoft Exchange Server.
The vulnerability is due to insufficient sanitization when handling a malicious request. A remote attacker may be able to exploit this to disclose data or execute arbitrary code within the context of the application, via a crafted HTTP request.

description-logoOutbreak Alert

Critical zero-day vulnerabilities that can allow the attacker to do a Remote Code Execution (RCE) on Microsoft Exchange Servers. FortiGuard has added multiple protections throughout the Security Fabric to safeguard its customers from attacks exploiting these zero-day vulnerabilities.

View the full Outbreak Alert Report

The Hive ransomware gang has received up to $100+ million in ransom payments from more than 1,300 victims according to a joint advisory released by the FBI, the U.S. Cybersecurity and Infrastructure Security Agency, and the Department of Health and Human Services.

View the full Outbreak Alert Report

In the year 2022, FortiGuard IPS and FortiGuard AV/Sandbox blocked three trillion and six trillion hits respectively from vulnerabilities, malware and 0-day attacks. Those encompassed several thousand varieties of Remote Code Execution, Cross-Site Scripting, Elevation of Privilege, Denial of Service, Trojans, Exploits. FortiGuard Labs alerted customers with numerous critical threats throughout the year based on factors such as proof-of-concept, attack vectors, impact, ease of attack, dependencies, and more. This annual report covers:>

View the full Outbreak Alert Report

affected-products-logoAffected Products

Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 9
Microsoft Exchange Server 2016 Cumulative Update 20
Microsoft Exchange Server 2016 Cumulative Update 19
Microsoft Exchange Server 2019 Cumulative Update 8

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Detail
2023-06-06 23.571 Sig Added
2023-03-08 23.508 Sig Added
2023-02-14 22.495 Sig Added
2022-12-27 22.464 Sig Added
2022-12-14 22.457 Sig Added
2022-10-24 22.420 Sig Added
2022-10-11 22.411 Sig Added
2022-10-03 22.405 Name:MS.
Exchange.
Server.
CVE-2021-34473.
Remote.
Code.
Execution:MS.
Exchange.
Server.
Autodiscover.
Remote.
Code.
Execution
2022-09-14 22.392 Sig Added
2021-10-27 18.186 Sig Added