Proself XXE Flaw Exploited in Japan
An actively exploited XML external entity (XXE) vulnerability in Northgrid's Proself online storage software allows attackers to steal account credentials and files from servers.
Japan's IPA issued an alert regarding a vulnerability in Proself, an online storage package developed by Northgrid Corporation. The flaw stems from improper handling of XML External Entity (XXE) references, allowing an attacker to submit crafted XML requests that cause the server to disclose arbitrary files, including files containing account information.
IPA confirmed that exploitation of this vulnerability has already been observed in the wild, prompting an urgent call for administrators to apply vendor-supplied updates or implement workarounds immediately. All editions and versions of Proself are affected. For Proself Enterprise/Standard Edition Ver.4 and earlier, which have reached end-of-support and will not receive patches, the vendor recommends discontinuing use or migrating to Ver.5 or later.
The vulnerability was rated 7.5 (Important) under CVSS v3 and 5.0 under CVSS v2. Given the active exploitation and potential for credential and file theft from exposed enterprise storage servers, organizations using Proself should prioritize patching or applying interim mitigations provided by the vendor.
Mentioned in this report
Detection guidance
Proself XXE Exploitation Attempt - XML External Entity in HTTP Request
Detects HTTP POST requests to Proself endpoints containing XML payloads with DOCTYPE declarations or ENTITY definitions indicative of XXE attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Proself XXE Exploitation Attempt - XML External Entity in HTTP Request
description: Detects HTTP POST requests to Proself application endpoints containing
XML with DOCTYPE or ENTITY declarations typical of XXE exploitation attempts.
tags:
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
c_uri|contains:
- /proself
- /upload
- /download
http_method: POST
c_useragent|contains:
- Mozilla
- curl
- wget
http_request_body|contains:
- <!DOCTYPE
- <!ENTITY
- SYSTEM
- PUBLIC
filter_legitimate_xml:
http_request_body|contains:
- soap:Envelope
- 'wsdl:'
condition: selection and not filter_legitimate_xml
falsepositives:
- Legitimate SOAP/WSDL API calls to Proself endpoints
- Administrative XML configuration uploads with DOCTYPE declarations
level: high
id: 0228a569-c486-53b5-b12d-cc2f152607e0
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/20231018-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free