Microsoft Exchange Server Exchange Control Panel Fixed Cryptographic Key Remote Code Execution Vulnerability

February 20th, 2020
ZDI-20-258 ZDI-CAN-9615

CVE ID

CVE-2020-0688

CVSS Score

8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Microsoft

Affected Products

Exchange

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange Server. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Exchange Control Panel web application. The product fails to generate a unique cryptographic key at installation, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

Additional Details

Microsoft has issued an update to correct this vulnerability. More details can be found at:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688

Disclosure Timeline

  • 2019-11-26 - Vulnerability reported to vendor
  • 2020-02-20 - Coordinated public release of advisory

Credit

Anonymous

Back to Advisories