CVE-2021-24085: 
vulnerability analysis and mitigation

Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-24085) was disclosed on February 25, 2021. The vulnerability affects Microsoft Exchange Server 2016 (Cumulative Update 18 and 19) and Exchange Server 2019 (Cumulative Update 7 and 8). This vulnerability is unique from CVE-2021-1730 (NVD).

The vulnerability has received a CVSS v3.1 base score of 5.5 (Medium) from NIST and 6.5 (Medium) from Microsoft. The vulnerability requires low attack complexity, low privileges, and user interaction for successful exploitation. The attack vector is network-based, with potential impacts on confidentiality, integrity, and availability (NVD).

Successful exploitation of this vulnerability could allow an attacker to gain privileged access to an Exchange server. The requests are transmitted through HTTPS, which may bypass standard Network Intrusion Detection Systems (NIDS) unless SSL/TLS decryption is implemented (AttackerKB).

The vulnerability requires authentication and user interaction for successful exploitation. An attacker must trick a privileged user (ideally an Exchange administrator) into clicking on a prepared link containing malicious JavaScript code. This code can then send requests to the Exchange Control Panel (ECP) on behalf of the administrator, potentially leading to system-level access via a downloaded web shell (AttackerKB).

The primary mitigation method is to apply the security patches provided by Microsoft. Organizations should also monitor system logs for potential exploitation attempts, though attackers may attempt to destroy these logs. For small to midsize organizations, special attention should be paid to HTTPS traffic monitoring (AttackerKB).

Security researchers have noted that despite requiring authentication and user interaction, the vulnerability is considered highly valuable to attackers due to the ubiquity of Exchange servers, the remote nature of the exploit, and the significant privileges that can be gained. A simple Python proof-of-concept was made available by security researcher Steven Seeley on February 15, 2021 (AttackerKB).