SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP Microsoft Exchange Server server side request forgery attempt
This rule detects an unauthenticated SSRF attack against vulnerable versions of Microsoft Exchange Server by looking for specific information supplied to a vulnerable cookie parameter.
What To Look For
This rule detects an unauthenticated SSRF attack against vulnerable versions of Microsoft Exchange Server.
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
Tactic: Initial Access
Technique: Exploit Public-Facing Application
For reference, see the MITRE ATT&CK vulnerability types here:
Server-Side Request Forgery
Server-Side Request Forgery (SSRF) attackers abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL for the server to read or submit data to. By carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests for internal services which are not intended to be exposed.
CVE Additional Information
CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
||Ease of Access||LOW