T 2.92 Poor control of browser access to Exchange

Exchange provides for the option of using a browser to access one's own email account. For this, the Internet Information Services (IIS) are used forming an integral part of the Exchange Server installation.

If this functionality is planned poorly and controlled improperly, this may allow for uncontrolled access to the internal network from the outside.

Misconfigurations primarily refer to the authentication of the web client to the Exchange Server, as well as the protected transmission of the information using the network. If the required authentication methods are too weak, unauthorised persons may possibly access email data and system resources. If the used encryption mechanisms are too weak, data may be intercepted. In the event of insufficient authentication and encryption mechanisms, established connections may possibly be taken over by unauthorised third parties. Furthermore, the Exchange Server may be infected with viruses and other harmful code via this channel.

Furthermore, the risk potential is manifold. The following are examples for further possible consequences:

• email addresses and contents may be spied out,
• unauthorised persons may access email functions,
• spam attacks may be allowed,
• unauthorised persons may obtain internal information about the company and/or the agency,
• direct possibilities for attacking the internal network may be the consequence