# CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery

Exchange frontend proxy trusts X-BEResource cookie to build backend URI, letting unauthenticated attackers SSRF to internal /ecp endpoints as the Exchange server.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft Microsoft Exchange Server
- Credited: Anthony Weems, Michael Weber, Dallas Kaman
- Disclosed: 2021-03-02
- CVE: CVE-2021-26855
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-26855.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-26855
- Tags: domain:web impact:internal-access impact:rce kind:incident platform:project-zero sev:critical tech:windows technique:chained technique:source-review vuln:auth-bypass vuln:ssrf

**Target:** Exchange frontend proxy (BEResourceRequestHandler) /ecp static resource handler
**Root cause:** BEResourceRequestHandler derives the backend anchor mailbox from the attacker-controlled X-BEResource cookie without hostname validation, and .NET UriBuilder string concatenation lets a crafted host (with @ and #) redirect the proxied request to an arbitrary backend path.
**Steps:**
1. Send request to any /ecp static resource path (e.g. `/ecp/favicon.ico`) with cookie `X-BEResource=@backend.example.local:444/ecp/proxyLogon.ecp#~1941962753`
2. Frontend parses cookie into BackEndServer(host, version) and builds Uri via UriBuilder concatenation, yielding `https://backend.example.local:444/ecp/proxyLogon.ecp#/ecp/favicon.ico`
3. Prefix host with `@` to defeat UriBuilder's IPv6 bracket handling when a port is specified
4. POST to `/ecp/proxyLogon.ecp` via SSRF with `msExchLogonMailbox: S-1-5-21-...-500` header and XML body `<r at="" ln=""><s>SID</s></r>`
5. Receive Set-Cookie ASP.NET_SessionId and msExchEcpCanary, authenticating to /ecp as the target user
**How found:** Likely code auditing of the frontend proxy and frontend-to-backend routing; noting BEResourceRequestHandler trusts the X-BEResource cookie and that UriBuilder concatenation mishandles crafted hosts.
**Exploitation:** Chain: leak backend hostname, leak a user SID, use SSRF to reach /ecp/proxyLogon.ecp and obtain authenticated ECP cookies, then pivot via SSRF to RCE gadgets (CVE-2021-26857/26858/27065); e.g. CVE-2021-27065 lists OABVirtualDirectory via DDIService, injects ASP webshell into ExternalUrl, resets to write to disk, then accesses webshell.
**Escalation:** SSRF + proxyLogon auth bypass chained to post-auth RCE (webshell via OABVirtualDirectory) enabling full server compromise; used by HAFNIUM in targeted attacks.
**Insight:** When a proxy builds backend URIs from client-controlled routing cookies, test host strings containing `@`, `#`, and `:` — UriBuilder treats `@` as userinfo and `#` as fragment, silently redirecting the request path and port to internal services.