View this email in your browser
Running on-prem Microsoft Exchange servers? 

If you didn’t catch the NSA boilerplate announcement, there’s another batch of vulnerabilities to scan for – and we built what you need. 

We just added a new detection module to our Network Vulnerability Scanner. It checks if your Exchange servers are vulnerable to the attack chain that exploits four recent CVEs and results in Remote Code Execution. 

Ours is the second scanning tool of its kind in the world that can identify vulnerable servers remotely. Here’s why we built it. 

No advisory? No PoC? No problem!

Since these CVEs were published (April 13, 2021), we’ve been looking for a detailed technical advisory – but it never came. No solid PoC exploit scripts surfaced either, so we took matters into our own hands.

Our team built a detection module that identifies Exchange servers vulnerable to the combination of pre-auth and post-auth vulnerabilities the NSA disclosed:

Bad actors love these because the first two vulns don’t even require authenticating to the exposed Exchange Server. All they have to do is to do thorough recon and send specially crafted requests to their target to get RCE.  

If you’ve already dealt with ProxyLogon (for which we launched a dedicated scanner in March), know these security weaknesses have a similar operation model.  

Find exposed servers

Patched or not? Detect the #proxynotfound attack chain 

A malicious actor can only exploit the last two CVEs in this batch if they authenticate to the vulnerable Exchange Server. But, by chaining two of these flaws, they can skip that step altogether. 

In April, we saw attackers use the same approach when they combined ProxyLogon with post-auth vulns to embed webshells and achieve persistence on unpatched Exchange servers. While this is not a replica of the ProxyLogon situation, we can use that cautionary tale to guide remediation efforts. 

Once you know which servers need patching, you can deploy the cumulative update Microsoft released for these issues. 

Go ahead of the curve & find exposed Exchange servers

Scan your network now

 If you have questions, need help, or want to share feedback, email us anytime at 

The Team

PS: If you need extra context, check out NSA’s announcement.

Let's stay in touch!
Copyright © 2021 PentestTools SRL, All rights reserved.
You are receiving this email because you opted in at our website or used in the past.

Our mailing address is:
PentestTools SRL
Caderea Bastiliei 64, 1st Floor
Bucharest, Romania EU

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list.