Report Details OWAReaper’s Exploitation of an Exchange OWA XSS Flaw
Summary
ReSecurity describes CVE-2026-42897 as stored XSS in on-premises Exchange OWA, reportedly exploited by TA488 to deploy the OWAReaper browser implant. It details mailbox persistence, token theft, command channels, patches and response steps.
Key points
- The article describes CVE-2026-42897 as stored XSS in on-premises Exchange OWA, triggered when a user opens a crafted HTML email.
- It attributes the reported exploitation to TA488 and says the OWAReaper implant runs JavaScript in the authenticated browser without installing conventional endpoint malware.
- The implant is described as harvesting browser autofill credentials, EWS OAuth tokens and mailbox information.
- The article says OWAReaper uses Exchange APIs to grant the built-in Default mailbox user Owner permissions, alongside LocalStorage and IndexedDB persistence.
- Reported command and data channels include the GitHub Commit Search API, cached email, encrypted HTTPS relayed through image CDNs, and DNS tunneling.
- The article lists patches for on-premises Exchange Server versions and says Exchange Online is not reported vulnerable.
- Recommended response includes patching, reviewing mailbox permissions, revoking EWS tokens, and inspecting OWA browser storage; the article says patching alone may not remove an existing implant.
Article Details
- Vulnerability Types
- Stored cross-site scripting (XSS)
- Severity
- High (CVSS 8.1)
- Affected Versions
- Exchange Server Subscription Edition RTM
- Exchange Server 2019 CU14 / CU15
- Exchange Server 2016 CU23
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- The article identifies EM Service rule M2.1.0 and the EOMT script as temporary mitigations; it says to remove or roll them back after patching.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | acocdn[.]com | Identified as the actor domain used for exfiltration traffic. |
| DOMAIN | asecdns[.]com | Listed as a known C2 domain to block. |
| DOMAIN | dnsrecursive[.]eu | Listed as a known C2 domain to block. |
| DOMAIN | tdndns[.]com | Listed as a known C2 domain to block. |
| SHA256 | 6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4 | Identified in the article's indicators table as the exploit SHA256. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe exploit conceals Base64-encoded JavaScript in image URL fragments before reconstructing it in the browser.T1041 · Exfiltration Over C2 ChannelOWAReaper exfiltrates mailbox data through its command-and-control communications.T1059.007 · JavaScriptThe XSS payload and OWAReaper execute attacker-controlled JavaScript in the authenticated OWA browser session.T1071.001 · Web ProtocolsThe article describes encrypted HTTPS communications and exfiltration relayed through image CDN services.T1071.003 · Mail ProtocolsThe article describes an email-based command channel that reads commands from cached Outlook messages.T1071.004 · DNSThe implant uses DNS tunneling as a fallback communication channel.T1098.002 · Additional Email Delegate PermissionsThe implant uses Exchange UpdateFolder to grant Owner permissions to the built-in Default mailbox user.T1102.002 · Bidirectional CommunicationOWAReaper polls the GitHub Commit Search API for encrypted commands and operator instructions.T1114.002 · Remote Email CollectionThe implant collects and exfiltrates mailbox email and other mailbox content through Exchange functionality.T1190 · Exploit Public-Facing ApplicationThe article describes exploitation of the vulnerability in internet-facing on-premises Exchange OWA.T1528 · Steal Application Access TokenOWAReaper obtains and steals EWS OAuth access tokens using GetClientAccessToken.T1555.003 · Credentials from Web BrowsersOWAReaper captures credentials saved for browser autofill.T1573.001 · Symmetric CryptographyThe article says commands and exfiltrated metadata are encrypted using AES-CTR.
CVE
Threat Actors
Malware
OWAReaperexecutes attacker-controlled JavaScript within the victim's authenticated OWA session, deploying the OWAReaper browser implant without dropping files to disk or requiring additional user interaction.ZimReaperResearchers have identified OWAReaper as an evolution of the earlier ZimReaper implant previously used against Zimbra webmail environments.
Vendors
Products
Microsoft Exchange ServerCVE-2026-42897 is a high-severity stored cross-site scripting (XSS) vulnerability affecting on-premises Microsoft Exchange Server Outlook Web Access (OWA).Microsoft Outlook Web Access (OWA)CVE-2026-42897 is a high-severity stored cross-site scripting (XSS) vulnerability affecting on-premises Microsoft Exchange Server Outlook Web Access (OWA).