Proself Auth Bypass RCE Exploited in Japan

21 August 2023 high vulnerability

Attackers are actively exploiting an authentication bypass and remote code execution flaw in Northgrid's Proself online storage software.

Japan's IPA issued an emergency advisory regarding a vulnerability in Proself, an online storage platform developed by Northgrid Inc. The flaw allows authentication bypass and remote code execution, and IPA confirmed that exploitation attempts are already occurring in the wild. The vendor disclosed the vulnerability on July 20, 2023, but IPA published this alert out of concern that many organizations using Proself may not yet be aware of the issue or have applied fixes.

Mentioned in this report

Vulnerabilities CVE-2023-36581

Detection guidance

Suspicious Child Process Spawned from IIS Worker Process (Possible Proself RCE)

ATT&CK T1190

Detects cmd.exe, powershell.exe, or cscript/wscript spawned by w3wp.exe, consistent with exploitation of a web application authentication bypass/RCE vulnerability such as the Proself flaw, where attacker commands execute in the context of the web server process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned from IIS Worker Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \certutil.exe
  filter:
    CommandLine|contains:
    - IISADMIN
    - w3wp.exe -ap
  condition: selection and not filter
  falsepositives:
  - Legitimate IIS management or health-check scripts that spawn helper processes
  - Custom ASP.NET applications intentionally invoking shell utilities for administrative
    tasks
  level: high
  tags:
  - attack.t1190
  - attack.execution
id: f7ccc0aa-7c87-553c-b47b-ad81f9b93a0a
status: experimental
author: Vorant

Web Server Process Writing Executable or Script Files to Web Root (Possible Webshell Drop via Proself Exploit)

ATT&CK T1190

Detects the IIS worker process (w3wp.exe) creating script or executable files, a common post-exploitation step after authentication bypass/RCE such as the Proself vulnerability, indicating a webshell or dropper being written to disk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: IIS Worker Process Dropping Script or Executable File
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|endswith:
    - .aspx
    - .asp
    - .ashx
    - .jsp
    - .php
    - .exe
    - .dll
  filter:
    TargetFilename|contains:
    - \Temporary ASP.NET Files\
    - \Microsoft.NET\Framework
  condition: selection and not filter
  falsepositives:
  - Legitimate application deployment or publishing processes writing new pages to
    the web root
  - Automated CI/CD pipelines updating web application files
  level: high
  tags:
  - attack.t1190
  - attack.persistence
id: afd2848e-47f3-5b62-ae75-a235de6b5a2f
status: experimental
author: Vorant

Outbound Network Connection Initiated by IIS Worker Process to Uncommon External Host

ATT&CK T1190

Detects w3wp.exe initiating outbound network connections, which may indicate a reverse shell or command-and-control channel established after exploiting a public-facing application vulnerability like the Proself auth bypass RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: IIS Worker Process Making Outbound Network Connection
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    Initiated: 'true'
  filter:
    DestinationPort:
    - 443
    - 80
  condition: selection and not filter
  falsepositives:
  - Web application legitimately making outbound API calls or license checks over
    non-standard ports
  - Health monitoring or telemetry agents integrated into the web application
  level: medium
  tags:
  - attack.t1190
  - attack.command_and_control
id: 760c8655-0b72-5535-a810-45ebd7d937ee
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230803.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free