0day Vulnerability in Microsoft 365 Exchange

It is possible to send email from any computer using an email client like Thunderbird or with code with .net SendMail, using SMTP relay and any valid Microsoft SMTP host like alpha-gr.mail.protection.outlook.com , using any username from a domain that is mail hosted at Microsoft (even if that username does not exist) and any password to an email account that is hosted on an online exchange mail server (Microsoft 365).

You cannot send emails, for example, to gmail or to your non-exchange online email.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

You also cannot send email to an account that belongs to the domain you are sending from, e.g. alpha.gr.

NOTE: some companies that have email in Microsoft 365, for security reasons, have placed a geographical restriction and if you try to send, for example, from microsoft-com.mail.protection.outlook.com you will get an error.

Create a fake email account in Thunderbird with

• SMTP alpha-gr.mail.protection.outlook.com, PORT 25, no connection security, no authentication method.
• In the incoming message, put something irrelevant (it doesn't matter) and put from otinane@alpha.gr

And send an email to an address that has an online exchange mail server (Microsoft 365).

You cannot send email to, for example, gmail or your non-exchange online email. You also cannot send email to an account that belongs to the domain you are sending from, for example, alpha.gr.

This is the web.config if you want to send email with .net SendMail.

The vulnerability has been reported to the Microsoft Security Response Center. VULN-159719 “Security issue when sending email with SMTP relay using *.mail.protection.outlook.com”

Submission number: VULN-159719

Case number: 100053

Microsoft did not issue a CVE and closed the case because they could not reproduce the vulnerability.

Manos Valergakis

Manos Valergakis

I have been involved with computers since 1993 and since 1999 I have been working as an IT professional in various businesses in the tourism industry.

I have been a Microsoft Partner since 2006 and we specialize in Office 365.

In my 26+ years of professional career, I have collaborated with many large technology companies in Greece, as well as in England, Germany and America. I have also collaborated with many tourist agencies in Greece and hotels in the field of computerization.

Since 2018, I have been an IT Manager at Cyberlogic, a company specializing in the production of travel agency management programs and based in Heraklion, Crete.