CVE-2021-31206: (Pwn2Own) Microsoft Exchange Server CabUtility ExtractCab Directory Traversal Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Microsoft Exchange Server. User interaction is required to exploit this vulnerability. The specific flaw exists within the parsing of CAB files. When handling filenames specified within a CAB file, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.0858.015Patch KB5004780 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.00.1497.023Patch KB5004778 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2242.012Patch KB5004779 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2308.014Patch KB5004779 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.0922.013Patch KB5004780
Event History
Frequently Asked Questions
What is CVE-2021-31206?
CVE-2021-31206 is a vulnerability that allows network-adjacent attackers to execute arbitrary code on affected installations of Microsoft Exchange Server.
Is user interaction required to exploit CVE-2021-31206?
Yes, user interaction is required to exploit this vulnerability.
How does the vulnerability in CVE-2021-31206 occur?
The vulnerability in CVE-2021-31206 occurs within the parsing of CAB files.
Which products are affected by CVE-2021-31206?
Microsoft Exchange Server 2013 (Cumulative Update 23), Microsoft Exchange Server 2016 (Cumulative Update 20 and Cumulative Update 21), and Microsoft Exchange Server 2019 (Cumulative Update 9 and Cumulative Update 10) are affected by CVE-2021-31206.
What is the severity of CVE-2021-31206?
CVE-2021-31206 has a severity score of 8, which is considered high.
How can I fix CVE-2021-31206?
To fix CVE-2021-31206, apply the relevant security updates provided by Microsoft.
Where can I find more information about CVE-2021-31206?
You can find more information about CVE-2021-31206 on the Microsoft Security Response Center website and the Zero Day Initiative website.