Here's the page we think you wanted. See search results instead:

Microsoft Exchange Server Fixed Cryptographic Key Remote Code Execution

Strike ID:
E20-0yy81
CVSS:
8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
False Positive:
f
Variants:
17
Year:
2020

Description

A remote code execution vulnerability exists in Microsoft Exchange Server due to a hardcoded validation key. A remote authenticated attacker may send a crafted serialized 'ViewState' object, which gets deserialized on the server to achieve remote code execution as the 'SYSTEM' user.

CVE

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-0688

References

https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys

Metasploit

http://www.zerodayinitiative.com/advisories/ZDI-20-258

Zdi

20-258