Microsoft Exchange Server Exploit Code Posted to GitHub

Exploit code for two Microsoft Exchange Server vulnerabilities under attack was published to GitHub earlier today. The Microsoft-owned platform quickly took down the proof-of-concept (PoC). 

The PoC combines CVE-2021-26855 and CVE-202127065, two of the four Exchange Server zero-days that attackers are using to break into Exchange Servers and deploy Web shells to steal data from target businesses. Since the flaws were patched on March 2, attacks have rapidly increased. At least 10 advanced persistent threat groups have started to weaponize these vulnerabilities to target servers. 

This marks the first fully functional exploit code to appear for the vulnerabilities, according to a new report from The Record, which notes that the PoC was published to GitHub by a Vietnamese security researcher. Other security researchers have confirmed it works, albeit with some adjustments. 

GitHub removed the code hours after its publication. In a statement to Vice, a spokesperson said the PoC code was removed because the vulnerability it exploits is under active attack. 

Read the full report for more details.