[Issue] CVE-2023-23397.ps1 is blocked by EwsAllowList even though impersonation lets you bypass this list

If the following configuration is set in Exchange OnPrem:

[PS] C:\>Get-OrganizationConfig | fl EwsAllowList,EwsApplicationAccessPolicy
EwsAllowList               : {Foobar}
EwsApplicationAccessPolicy : EnforceAllowList

This blocks the CVE-2023-23397.ps1 script from working. The error shows:

Unable to connect to EWS endpoint. Please make sure you have enter valid credentials. Inner Exception

The request failed. The remote server returned an error: (403) Forbidden.

However, if you use EWS Editor with impersonation, the impersonation right allows you to bypass the allow list.

In the script, this fails, because the function CheckOnpremCredentials does not use impersonation when checking the credentials. Thus, it's treated as a normal client and is blocked by the allow list, even though impersonation rights should let us bypass that.

Commenting out this line makes the script work fine:

[Microsoft.Exchange.WebServices.Data.Folder]::Bind($ewsService, [Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::MsgFolderRoot)

Start with CVE-2023-23397.ps1 and the CheckOnpremCredentials function, then inspect the Microsoft.Exchange.WebServices.Data.Folder::Bind call shown in the issue. Reproduce the 403 response with EwsAllowList and EwsApplicationAccessPolicy set to EnforceAllowList, and compare the script's credential check with the stated impersonation behavior. Done means the script's on-premises credential check works under the described configuration.