CVE-2021-31198: 
vulnerability analysis and mitigation

Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198) was discovered and reported on April 7, 2021. The vulnerability affects Microsoft Exchange Server installations and was publicly disclosed on July 22, 2021 (ZDI Advisory).

The vulnerability exists within the OAB (Offline Address Book) service of Microsoft Exchange Server. The specific flaw stems from the lack of proper validation of user-supplied data, which can allow arbitrary files to be written to OAB folders. The vulnerability has been assigned a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating its high severity (ZDI Advisory).

When successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of SYSTEM on affected Microsoft Exchange Server installations. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed (ZDI Advisory).

The vulnerability requires network access and low privilege levels for exploitation, with no user interaction needed as indicated by the CVSS metrics. The authentication bypass capability makes this vulnerability particularly concerning for affected systems (ZDI Advisory).

Microsoft has released a security update to address this vulnerability. Organizations running affected versions of Microsoft Exchange Server should apply the available patches immediately (ZDI Advisory).