Exploit for Server-Side Request Forgery in Microsoft

CVE-2021-26855 CVE-2021-26857

githubexploit · 2021-03-16

Description

A server side request forgery exploit chaining two Microsoft Exchange vulnerabilities called ProxyLogon.

Affected Microsoft Exchange Server versions

Microsoft Exchange Server= 2013, 2016, 2019, 2010

All known vulnerabilities by product

Exchange Server

CVSS Score

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:NONE

Working code

100%confidence this exploit runs

Based on 3 file(s) in the source

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-08-21

Exploit Details

Modified:2021-03-24 16:54

Last Seen:2025-09-06 11:03

Reporter:Immersive-Labs-Sec

Written in:Python

Last commit:2021-03-22

Tags

server siderequest forgeryproxylogon

Other exploits for the same CVE

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

Microsoft_Exchange_Server_SSRF_CVE-2021-26855

2026-08-27 KitPloitKITPLOIT

CVE-2021-26855_SSRF

2026-08-27 KitPloitKITPLOIT

ProxyLogon-CVE-2021-26855-metasploit

2026-08-27 KitPloitKITPLOIT

CVE-2021-26855-Scanner

2026-08-27 KitPloitKITPLOIT

ProxyLogon-CVE-2021-26855

2026-08-27 KitPloitKITPLOIT

ExchangeSSRFtoRCEExploit

2026-08-27 KitPloitKITPLOIT

Exploit Code

README7 lines

## https://sploitus.com/exploit?id=7275794A-F2F6-51E6-B514-185E494D8A3F
Disclaimer: All the information provided in this repository is for educational and research purposes only. The autor is no way responsible for any misuse of the information or code present here.

To use this exploit in a safe pre-configured environment check out https://community.immersivelabs.online/signin and sign up for a free account.

# ProxyLogon
Chaining CVE-2021-26855 and CVE-2021-26857 to exploit Microsoft Exchange