CVE-2020-0688

Related Files

Exchange Control Panel Viewstate Deserialization

Posted Mar 4, 2020

Authored by Spencer McIntyre | Site metasploit.com

This Metasploit module exploits a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these, values an attacker can craft a special viewstate to cause an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization.

tags | exploit, web

advisories | CVE-2020-0688

SHA-256 | 9ba178072e43dcc78183e17a6aebcaa356ad487774d5b60829b0623367acc1fb

Download | Favorite | View

Microsoft Exchange 2019 15.2.221.12 Remote Code Execution

Posted Mar 2, 2020

Authored by Photubias

Microsoft Exchange 2019 version 15.2.221.12 suffers from an authenticated remote code execution vulnerability.

tags | exploit, remote, code execution

advisories | CVE-2020-0688

SHA-256 | 2209d610405eecbd97899d9712efd45c455cffc7e713903504d884634ddf470f

Download | Favorite | View