What debugging steps are recommended for analyzing CVE-2021-34473, and why is the environment setup important?
The article recommends setting up a debugging environment by first disabling JIT optimization in Visual Studio via the `COMPLUS_ZapDisable=1` environment variable and restarting the system. Then, use `appcmd list wp` to identify Exchange worker process IDs, and attach dnSpy to the relevant `w3wp.exe` processes. Debugging is essential for understanding the SSRF trigger conditions and the flow from the `/autodiscover` endpoint to the internal `/mapi/nspi` call. The analysis also helps in confirming that the vulnerability runs with SYSTEM privileges, as shown in the original ProxyShell research.
debuggingdnSpyenvironment setupw3wp.exeCOMPLUS_ZapDisableprocess identification