IPA warns of ongoing attacks exploiting vulnerabilities in internet-facing online storage…
IPA warns of ongoing attacks exploiting vulnerabilities in internet-facing online storage solutions, including Proself, with APT involvement confirmed.
Japan's Information-Promotion Agency (IPA) has issued an alert regarding continued exploitation of vulnerabilities in internet-connected online storage systems. The agency specifically highlights attacks targeting Proself software, which contains critical vulnerabilities including authentication bypass (CVE-2023-39415) and OS command injection (CVE-2023-39416), both of which are confirmed to be actively exploited. Additionally, new information has been released regarding exploitation of XML External Entity (XXE) vulnerabilities in these systems.
IPA expresses concern that many organizations have not implemented appropriate security measures despite ongoing warnings. The agency notes that nation-state APT groups are involved in these campaigns, which have previously targeted other file-sharing solutions including FileZen and MOVEit. These attacks have resulted in data breaches, with organizations increasingly relying on online storage for inter-organizational data exchange beyond traditional email.
IPA urges organizations using online storage products to consult with vendors and system operators to implement proper countermeasures immediately. The agency also warns that OEM products may be affected by publicly disclosed vulnerabilities in the original software, emphasizing the importance of supply chain security awareness. Organizations are encouraged to report unauthorized access incidents to IPA to aid in understanding attack patterns and preventing further damage.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Java/Web Application Server (Possible Proself OS Command Injection)
Detects a web application or Java-based server process (e.g., Tomcat/Proself) spawning a command interpreter, consistent with exploitation of OS command injection vulnerabilities such as CVE-2023-39416. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Interpreter Spawned by Java or Web Server Process
id: 516f5adc-47b5-5385-a0d7-d632949d3931
status: experimental
description: Detects cmd.exe, powershell.exe, or /bin/sh being spawned as a child
of a Java or web application server process, which may indicate exploitation of
an OS command injection vulnerability in internet-facing storage/file-sharing software
such as Proself.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.T1059
- attack.T1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \w3wp.exe
- \httpd.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \wscript.exe
- \cscript.exe
filter_benign:
CommandLine|contains:
- catalina
- startup.bat
- shutdown.bat
condition: selection_parent and selection_child and not filter_benign
falsepositives:
- Legitimate administrative scripts invoked by Tomcat/Java management tools
- Scheduled maintenance scripts launched from application server service accounts
level: high
Reconnaissance Commands Executed via Command Shell Spawned by Web Application Process
Detects common Windows reconnaissance commands (whoami, net, ipconfig, systeminfo) executed by a cmd.exe process whose parent is a Java or web server process, indicative of post-exploitation activity following exploitation of an internet-facing storage application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands via cmd.exe Child of Web Application Process
id: 225312fb-2fd8-5d7b-96b4-6688745177dc
status: experimental
description: Detects execution of common discovery commands (whoami, net, ipconfig,
systeminfo, tasklist) launched by cmd.exe whose parent process is a Java-based web
application or web server, consistent with post-exploitation reconnaissance after
exploiting a command injection vulnerability in internet-facing file-sharing software.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.T1059.003
- attack.T1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \w3wp.exe
- \httpd.exe
selection_cmd:
Image|endswith: \cmd.exe
selection_recon:
CommandLine|contains:
- whoami
- net user
- net localgroup
- ipconfig
- systeminfo
- tasklist
- query user
condition: selection_parent and selection_cmd and selection_recon
falsepositives:
- Legitimate health-check or monitoring scripts issuing system information commands
from application server accounts
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20231019.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free