On January 11, 2022, Microsoft released a patch for a critical security vulnerability designated as CVE-2022-21846. This vulnerability affects Microsoft Exchange Server and allows a remote attacker to execute arbitrary code on vulnerable systems. While there have been several Exchange vulnerabilities, such as CVE-2022-21855 and CVE-2022-21969, it's important to understand that CVE-2022-21846 is unique in how attackers can exploit it.

In this post, we will break down what CVE-2022-21846 is, show you what makes it dangerous, explore its exploitability, and provide actionable steps for defense.

What is CVE-2022-21846?

CVE-2022-21846 is a Remote Code Execution (RCE) vulnerability in Microsoft Exchange Server, affecting multiple versions:

Microsoft Exchange Server 2019

This bug is particularly dangerous because an attacker does not need to be authenticated, nor do they need to have physical access to the server. All it takes is access to the Exchange server exposed to the internet, and a specially crafted request.

The original Microsoft advisory:  
đź”— Microsoft Security Response Center: CVE-2022-21846

How Does the Vulnerability Work?

At its core, CVE-2022-21846 is a remote code execution flaw in the Exchange Server due to improper validation of user input in its handling of certain web requests. Attackers can send malicious input which the server fails to properly sanitize, allowing them to run code of their choice.

No Authentication required

- Network attack via HTTP/HTTPS

Proof-of-Concept (PoC): Example Exploit

While Microsoft did not publish full technical details, security researchers traced the bug to issues in the Exchange Control Panel (ECP) component. Below is a reconstructed concept based on available information and similar past vulnerabilities.

DISCLAIMER: For educational purposes only. Do not use these techniques against any system you do not own or have permission to test.

import requests

TARGET = "https://exchange.yourcompany.com/owa/auth.owa";
payload = "malicious_payload_goes_here"

headers = {
    "Content-Type": "application/x-www-form-urlencoded"
}

# This would represent a crafted request hitting the vulnerable endpoint.
data = {
    "somefield": payload
}

response = requests.post(TARGET, data=data, headers=headers, verify=False)

print(f"HTTP Status: {response.status_code}")
print(response.text)

In real world attacks, the malicious payload would exploit the input validation flaw in the backend, causing Exchange to execute arbitrary code under the context of the Exchange service account.

Attackers send a poisoned (malformed) HTTP request to certain Exchange endpoints.

- The backend processes this input, and due to improper sanitization, malicious commands are executed on the server.
- Upon successful exploitation, attackers can drop webshells, escalate privileges, or expand their attack to the internal network.

CVE-2022-21969: A different code execution bug, found in another part of Exchange.

CVE-2022-21846 stands apart due to its remote, unauthenticated exploitation vector and the high impact of possible server takeover.

Apply Microsoft’s January 2022 Exchange Server updates. Get the latest

- Exchange Server Updates Download

Resources & Further Reading

- Microsoft Security Advisory for CVE-2022-21846
- Rapid7 Analysis on January 2022 Exchange Bugs
- Exchange Team Blog: January 2022 Updates
- CERT/CC FAQ on Exchange RCEs

Closing Thoughts

CVE-2022-21846 is a prime example of why Exchange servers remain a high-value target. Its unauthenticated exploitation potential puts any unpatched Exchange server at risk of a complete compromise.

If you run Exchange, do not delay -- patch as soon as possible, review server exposure, and watch for suspicious activity in your environment. Staying ahead means keeping your systems updated and watching industry news for new threats as they emerge.

Timeline

Published on: 01/11/2022 21:15:00 UTC
Last modified on: 01/14/2022 17:33:00 UTC