Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Unpatched Microsoft Exchange management interfaces are not traditionally exposed to the internet and can only be exploited by authenticated attackers. An authenticated attacker can exploit the deserialization vulnerabilities CVE-2023-28310, CVE-2023-21706, and CVE-2023-2159, which can lead to RCE.
Kill Chain
Risk Score
88
Microsoft Exchange Server has vulnerabilities (CVE-2023-28310, CVE-2023-21706, and CVE-2023-21529) that can lead to RCE. An authenticated attacker that has established a PowerShell connection with an Exchange Server sends a SOAP message that contains PowerShell objects with a malicious XamlReader payload. The PowerShell objects bypass any restrictions in Microsoft Exchange Management Shell and run the attacker’s embedded code.
