Proself Auth Bypass RCE Exploited in Japan
Attackers are actively exploiting an authentication bypass and remote code execution flaw in Northgrid's Proself online storage software.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA issued an emergency advisory regarding a vulnerability in Proself, an online storage platform developed by Northgrid Inc. The flaw allows authentication bypass and remote code execution, and IPA confirmed that exploitation attempts are already occurring in the wild. The vendor disclosed the vulnerability on July 20, 2023, but IPA published this alert out of concern that many organizations using Proself may not yet be aware of the issue or have applied fixes.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from IIS Worker Process (Possible Proself RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects cmd.exe, powershell.exe, or cscript/wscript spawned by w3wp.exe, consistent with exploitation of a web application authentication bypass/RCE vulnerability such as the Proself flaw, where attacker commands execute in the context of the web server process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from IIS Worker Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \mshta.exe
- \certutil.exe
filter:
CommandLine|contains:
- IISADMIN
- w3wp.exe -ap
condition: selection and not filter
id: f7ccc0aa-7c87-553c-b47b-ad81f9b93a0a
status: experimental
author: Vorant
level: high
tags:
- attack.t1190
- attack.execution
falsepositives:
- Legitimate IIS management or health-check scripts that spawn helper processes
- Custom ASP.NET applications intentionally invoking shell utilities for administrative
tasks
Web Server Process Writing Executable or Script Files to Web Root (Possible Webshell Drop via Proself Exploit)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the IIS worker process (w3wp.exe) creating script or executable files, a common post-exploitation step after authentication bypass/RCE such as the Proself vulnerability, indicating a webshell or dropper being written to disk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Dropping Script or Executable File
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|endswith:
- .aspx
- .asp
- .ashx
- .jsp
- .php
- .exe
- .dll
filter:
TargetFilename|contains:
- \Temporary ASP.NET Files\
- \Microsoft.NET\Framework
condition: selection and not filter
id: afd2848e-47f3-5b62-ae75-a235de6b5a2f
status: experimental
author: Vorant
level: high
tags:
- attack.t1190
- attack.persistence
falsepositives:
- Legitimate application deployment or publishing processes writing new pages to the
web root
- Automated CI/CD pipelines updating web application files
Outbound Network Connection Initiated by IIS Worker Process to Uncommon External Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects w3wp.exe initiating outbound network connections, which may indicate a reverse shell or command-and-control channel established after exploiting a public-facing application vulnerability like the Proself auth bypass RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Making Outbound Network Connection
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
Initiated: 'true'
filter:
DestinationPort:
- 443
- 80
condition: selection and not filter
id: 760c8655-0b72-5535-a810-45ebd7d937ee
status: experimental
author: Vorant
level: medium
tags:
- attack.t1190
- attack.command-and-control
falsepositives:
- Web application legitimately making outbound API calls or license checks over non-standard
ports
- Health monitoring or telemetry agents integrated into the web application
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230803.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs