Exchange Server
Microsoft's on-premises mail and calendar server.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- AppExchange Server
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Exchange Server handles company email, calendars and contacts. On premises it runs on Windows Server under IIS, with Outlook on the web reached through the /owa/ path. Exchange Online is the hosted version in Microsoft 365.
How to Spot It
These are signs that a system runs Exchange Server, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Path
/owa/- Path
/ecp/- Response header
X-OWA-Version: 15.2.1544.4
If It Has a Flaw
Exchange holds every mailbox. By default its servers can also create and change objects across Active Directory, the directory of every account in the domain. So a flaw in it often means the whole mail store and a path to the domain. Microsoft's Active Directory split permissions model narrows that reach.
If Exchange Server has a flaw, nothing runs on it, but it holds every mailbox and, by default, rights to create and change objects across Active Directory, so the flaw can reach the domain itself.
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Exchange Server sits.
CVE-2021-26855 (opens in a new tab)2021
ProxyLogon
A server-side request forgery flaw let an attacker authenticate as the Exchange server.
Reach It opened the mail store and a path into Active Directory.
CVE-2021-34473 (opens in a new tab)2021
ProxyShell
Chained with two other flaws, it let attackers run code on unpatched Exchange.
Reach It gave full control of the mail server without a password.
Stacks and Code
Exchange Server is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- In Common Stacks
- Exchange, On Premises
- Its Code Comes From
- Vendor Updates