'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app: microsoft_exchange_ssrf_vul:postxml（Rule ID：1070210157）

Release Date：2025/9/15

Rule Name：CVE-2021-26855: Microsoft Exchange Server-side Request Forge Vulnerability:PostXml

Severity：critical

CVE ID：CVE-2021-26855

 

Descripiton：

Microsoft Exchange Server is a set of e-mail service programs of Microsoft Corporation. It provides mail access, storage, forwarding, voice mail, mail filtering and other functions. Microsoft Exchange Server have security vulnerabilities. Attackers can construct malicious HTTP requests and authenticate themselves through Exchange Server. Then scan the intranet to obtain sensitive user information. The following products and versions are affected: Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 7, Microsoft Exchange Server 2016 Cumulative Update 18, Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.