ProxyLogon Is Just the Tip of the Iceberg: New Attack Surface on Exchange
Orange Tsai reveals a revolutionary attack surface on Microsoft Exchange Server, chaining pre-auth SSRF, authentication bypass, and post-auth RCE into ProxyLogon, ProxyOracle, and ProxyShell.
Summary
Targeting Microsoft Exchange as the Enterprise Crown Jewels
Microsoft Exchange Server manages confidential email, calendar data, and directory trusts for global governments and enterprises, making it a premier nation-state target.
Discovering the Frontend Architecture Weakness
Orange Tsai analyzes the HTTP proxy architecture in Exchange (`HttpProxy`), discovering severe parsing inconsistencies between the frontend reverse proxy and backend PowerShell/EWS endpoints.
The Triple Exploitation Chain: ProxyLogon, ProxyOracle, ProxyShell
Tsai details his discovery of three complete exploitation architectures, demonstrating how pre-authentication SSRF and cookie manipulation yield SYSTEM-level remote code execution on fully patched servers.
Transforming Enterprise Email Security
The research prompted emergency out-of-band security advisories from Microsoft, CISA, and national cyber agencies worldwide.
Related talks
Main Stage·36 min
Jeffrey Hofmann
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Main Stage·32 min
Samuel Erb · Justin Gardner
Samuel Erb and Justin Gardner share the story of finding and exploiting a complex RCE exploit chain against KASM Workspaces streaming software.