IIRC Bitfinex, Bitstamp, and Kraken use BitGo to store their Bitcoin. They interact with Bitgo via an API. Other exchanges may be doing the same. They may also be rolling their own wallet software. Some may also be using Bitcoin Core.
Some exchanges also use Armory to store their Bitcoin.
Presumably when you request an address, you send a request to the web server which then sends a request to some other server which has the addresses to get the address that it then serves to you.
How exchanges are actually setup is generally not known to people outside of the exchange. This sort of security critical infrastructure is not revealed to the public so that they can get some security through obscurity.