Saint ProxyToken, Who Didn't Ask for the Password

Patron of Microsoft Exchange, delegated authentication tokens, and those who forward without checking.

Life

On 30 August 2021 Simon Zuckerbraun of the Zero Day Initiative described ProxyToken, an authentication bypass in Microsoft Exchange. A request with a particular cookie was forwarded to a back-end that should have authenticated it but, in that configuration, did not: so one could change another person's mailbox settings, for instance to forward their mail to oneself. Another piece of Exchange's dark season.

Prayer

O Saint ProxyToken, who passes the checks that nobody performs, let every forwarded request still find someone to verify it. Amen.

How to celebrate

Celebrated by installing Exchange patches and checking that nobody has quietly added forwarding rules.

A check deferred is a check never made.