Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-45502 — Microsoft Exchange Server EWS InstallApp Server-Side Request Forgery

aretiq.ai | research | CVE-2026-45502 | #cloud | #ssrf | #exchange-server | #cve-2026-45502 | #ews | #on-premises

Summary

CVE-2026-45502: Exchange EWS InstallApp SSRF—the intranet address check is gated on isBposUser, false in all on-prem deployments, letting authenticated users reach arbitrary internal URLs.
CVE
CVE-2026-45502
Published
Collected

original ↗

Related coverage

research · portswigger.net
Cracking the lens: targeting HTTP's hidden attack-surface
James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.
research · portswigger.net
Portable Data exFiltration: XSS for PDFs
Gareth Heyes shows how a single injected hyperlink can compromise PDFs: injecting PDF code to execute JavaScript, exfiltrate contents in Acrobat and PDFium, and trigger SSRF on server-side renders.
research · portswigger.net
Hidden OAuth attack vectors
Three new OAuth2/OpenID Connect vectors — Dynamic Client Registration SSRF by design, redirect_uri session poisoning, WebFinger user enumeration — shown on ForgeRock OpenAM and MITREid Connect.
research · portswigger.net
Adapting Burp extensions for tailored pentesting
James Kettle shows how to customize open-source Burp extensions for tailored pentesting, modifying Collaborator Everywhere to inject SSRF-prone parameters found via Bugcrowd's HUNT.
research · hackenproof.com
How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise
A CTF postmortem: five chained flaws — from exiftool metadata revealing wkhtmltopdf, through traversal, SSRF and command injection — produced an unauthenticated CVSS 10.0 RCE in 3h15m.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
back