# A New Attack Surface on MS Exchange Part 1 - ProxyLogon!

Pre-auth SSRF in Exchange CAS static-resource handler plus ECP arbitrary-file-write chain lets unauthenticated attackers write a webshell and run commands as SYSTEM.

- Payout: unconfirmed
- Severity: critical
- Program: Microsoft
- Credited: Orange Tsai
- Disclosed: 2021-08-18
- CVE: CVE-2021-26855, CVE-2021-27065
- Write-up quality: 9/10
- Original: https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-1-ProxyLogon/
- Library page: https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:windows technique:chained technique:source-review vuln:auth-bypass vuln:file-upload vuln:rce vuln:ssrf

**Target:** Exchange Client Access Service (CAS) frontend proxy and ECP backend
**Root cause:** OwaResourceProxyRequestHandler derives the backend URL from the attacker-controlled X-AnonResource-Backend cookie, and C# UriBuilder does not validate the Host, allowing arbitrary backend/port targeting. ECP's WriteFileActivity writes attacker-controlled content to an unchecked file path.
**Steps:**
1. Send request to a static-resource path (e.g. `/owa/auth/x.js`) with cookie `X-AnonResource-Backend=https://[foo]@example.com:443/path#]:444` to redirect the proxy to an arbitrary host/port.
2. Use the SSRF to reach the internal ECP backend `/proxyLogon.ecp`, supplying header `msExchLogonMailbox` (not blocked by frontend) to impersonate SYSTEM and obtain a valid ECP session.
3. Invoke ECP DDIService pipeline (e.g. ResetOABVirtualDirectory.xaml) with Set-OABVirtualDirectory output written via WriteFileActivity to a path under the webroot.
4. Access the written webshell over port 443 to execute arbitrary commands as SYSTEM.
**How found:** Reasoned that CAS is an HTTP proxy and that a single request could be interpreted differently by frontend and backend; reviewed handlers and found GetTargetBackEndServerUrl trusts the X-AnonResource-Backend cookie, then abused frontend/backend header-handling inconsistency (msExchLogonMailbox) and audited DDI XAML pipelines for unchecked file writes.
**Exploitation:** Unauthenticated attacker sends a single crafted HTTP request to port 443; the frontend proxy attaches a Kerberos ticket for the Exchange machine account and forwards to the attacker-chosen backend. Chaining the SSRF with ECP header forgery yields admin ECP access, then the arbitrary-file-write drops a webshell in the webroot for RCE.
**Escalation:** SSRF (CVE-2021-26855) chained with ECP auth bypass via msExchLogonMailbox header and arbitrary-file-write (CVE-2021-27065) to achieve pre-auth RCE.
**Insight:** When a reverse proxy and backend disagree on which headers are trusted, look for headers the frontend fails to strip (like msExchLogonMailbox) and for proxy routing decisions driven by client cookies; also audit XAML/workflow-defined file-write activities for missing path validation.