Proself online storage targeted by APT-backed attacks
IPA warns of ongoing attacks exploiting vulnerabilities in internet-facing online storage solutions, including Proself, with APT involvement confirmed.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's Information-Promotion Agency (IPA) has issued an alert regarding continued exploitation of vulnerabilities in internet-connected online storage systems. The agency specifically highlights attacks targeting Proself software, which contains critical vulnerabilities including authentication bypass (CVE-2023-39415) and OS command injection (CVE-2023-39416), both of which are confirmed to be actively exploited. Additionally, new information has been released regarding exploitation of XML External Entity (XXE) vulnerabilities in these systems.
IPA expresses concern that many organizations have not implemented appropriate security measures despite ongoing warnings. The agency notes that nation-state APT groups are involved in these campaigns, which have previously targeted other file-sharing solutions including FileZen and MOVEit. These attacks have resulted in data breaches, with organizations increasingly relying on online storage for inter-organizational data exchange beyond traditional email.
IPA urges organizations using online storage products to consult with vendors and system operators to implement proper countermeasures immediately. The agency also warns that OEM products may be affected by publicly disclosed vulnerabilities in the original software, emphasizing the importance of supply chain security awareness. Organizations are encouraged to report unauthorized access incidents to IPA to aid in understanding attack patterns and preventing further damage.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Java/Web Application Server (Possible Proself OS Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web application or Java-based server process (e.g., Tomcat/Proself) spawning a command interpreter, consistent with exploitation of OS command injection vulnerabilities such as CVE-2023-39416. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Interpreter Spawned by Java or Web Server Process
id: 516f5adc-47b5-5385-a0d7-d632949d3931
status: experimental
description: Detects cmd.exe, powershell.exe, or /bin/sh being spawned as a child
of a Java or web application server process, which may indicate exploitation of
an OS command injection vulnerability in internet-facing storage/file-sharing software
such as Proself.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \w3wp.exe
- \httpd.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \wscript.exe
- \cscript.exe
filter_benign:
CommandLine|contains:
- catalina
- startup.bat
- shutdown.bat
condition: selection_parent and selection_child and not filter_benign
falsepositives:
- Legitimate administrative scripts invoked by Tomcat/Java management tools
- Scheduled maintenance scripts launched from application server service accounts
level: high
Reconnaissance Commands Executed via Command Shell Spawned by Web Application Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects common Windows reconnaissance commands (whoami, net, ipconfig, systeminfo) executed by a cmd.exe process whose parent is a Java or web server process, indicative of post-exploitation activity following exploitation of an internet-facing storage application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands via cmd.exe Child of Web Application Process
id: 225312fb-2fd8-5d7b-96b4-6688745177dc
status: experimental
description: Detects execution of common discovery commands (whoami, net, ipconfig,
systeminfo, tasklist) launched by cmd.exe whose parent process is a Java-based web
application or web server, consistent with post-exploitation reconnaissance after
exploiting a command injection vulnerability in internet-facing file-sharing software.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1059.003
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \w3wp.exe
- \httpd.exe
selection_cmd:
Image|endswith: \cmd.exe
selection_recon:
CommandLine|contains:
- whoami
- net user
- net localgroup
- ipconfig
- systeminfo
- tasklist
- query user
condition: selection_parent and selection_cmd and selection_recon
falsepositives:
- Legitimate health-check or monitoring scripts issuing system information commands
from application server accounts
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20231019.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs