{"uuid": "0a1c9e21-2b27-498c-9c05-633746d07be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34473", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64, x86, cmd\", \"author\": [\"Orange Tsai\", \"Jang ( \", \"PeterJson\", \"brandonshi123\", \"mekhalleh (RAMELLA S\\u00e9bastien)\", \"Donny Maasland\", \"Rich Warren\", \"Spencer McIntyre\", \"wvu \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability on Microsoft Exchange Server that\\n          allows an attacker to bypass the authentication (CVE-2021-31207), impersonate an\\n          arbitrary user (CVE-2021-34523) and write an arbitrary file (CVE-2021-34473) to achieve\\n          the RCE (Remote Code Execution).\\n\\n          By taking advantage of this vulnerability, you can execute arbitrary\\n          commands on the remote Microsoft Exchange Server.\\n\\n          This vulnerability affects Exchange 2013 CU23 < 15.0.1497.15,\\n          Exchange 2016 CU19 < 15.1.2176.12, Exchange 2016 CU20 < 15.1.2242.5,\\n          Exchange 2019 CU8 < 15.2.792.13, Exchange 2019 CU9 < 15.2.858.9.\\n\\n          All components are vulnerable by default.\", \"disclosure_date\": \"2021-04-06\", \"fullname\": \"exploit/windows/http/exchange_proxyshell_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Microsoft Exchange ProxyShell RCE\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"ProxyShell\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/exchange_proxyshell_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/exchange_proxyshell_rce\", \"references\": [\"CVE-2021-34473\", \"CVE-2021-34523\", \"CVE-2021-31207\", \"URL-https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1\", \"URL-https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf\", \"URL-https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/\", \"URL-https://github.com/dmaasland/proxyshell-poc\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows Powershell\", \"Windows Dropper\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:47.570961Z"}