# Proself Auth Bypass RCE Exploited in Japan

Published: 2023-08-21 · Severity: high
Canonical: https://vorant.io/reports/fbab64fc-3cf7-5a25-8878-69ca82b866bf/proself-auth-bypass-rce-exploited-in-japan

> Attackers are actively exploiting an authentication bypass and remote code execution flaw in Northgrid's Proself online storage software.

Japan's IPA issued an emergency advisory regarding a vulnerability in Proself, an online storage platform developed by Northgrid Inc. The flaw allows authentication bypass and remote code execution, and IPA confirmed that exploitation attempts are already occurring in the wild. The vendor disclosed the vulnerability on July 20, 2023, but IPA published this alert out of concern that many organizations using Proself may not yet be aware of the issue or have applied fixes.

## Mentioned in this report

- Vulnerabilities: CVE-2023-36581

## Detection guidance (public sample)

### Suspicious Child Process Spawned from IIS Worker Process (Possible Proself RCE)

ATT&CK: T1190

Detects cmd.exe, powershell.exe, or cscript/wscript spawned by w3wp.exe, consistent with exploitation of a web application authentication bypass/RCE vulnerability such as the Proself flaw, where attacker commands execute in the context of the web server process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from IIS Worker Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \certutil.exe
  filter:
    CommandLine|contains:
    - IISADMIN
    - w3wp.exe -ap
  condition: selection and not filter
  falsepositives:
  - Legitimate IIS management or health-check scripts that spawn helper processes
  - Custom ASP.NET applications intentionally invoking shell utilities for administrative
    tasks
  level: high
  tags:
  - attack.t1190
  - attack.execution
id: f7ccc0aa-7c87-553c-b47b-ad81f9b93a0a
status: experimental
author: Vorant
```

### Web Server Process Writing Executable or Script Files to Web Root (Possible Webshell Drop via Proself Exploit)

ATT&CK: T1190

Detects the IIS worker process (w3wp.exe) creating script or executable files, a common post-exploitation step after authentication bypass/RCE such as the Proself vulnerability, indicating a webshell or dropper being written to disk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Dropping Script or Executable File
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|endswith:
    - .aspx
    - .asp
    - .ashx
    - .jsp
    - .php
    - .exe
    - .dll
  filter:
    TargetFilename|contains:
    - \Temporary ASP.NET Files\
    - \Microsoft.NET\Framework
  condition: selection and not filter
  falsepositives:
  - Legitimate application deployment or publishing processes writing new pages to
    the web root
  - Automated CI/CD pipelines updating web application files
  level: high
  tags:
  - attack.t1190
  - attack.persistence
id: afd2848e-47f3-5b62-ae75-a235de6b5a2f
status: experimental
author: Vorant
```

### Outbound Network Connection Initiated by IIS Worker Process to Uncommon External Host

ATT&CK: T1190

Detects w3wp.exe initiating outbound network connections, which may indicate a reverse shell or command-and-control channel established after exploiting a public-facing application vulnerability like the Proself auth bypass RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Making Outbound Network Connection
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    Initiated: 'true'
  filter:
    DestinationPort:
    - 443
    - 80
  condition: selection and not filter
  falsepositives:
  - Web application legitimately making outbound API calls or license checks over
    non-standard ports
  - Health monitoring or telemetry agents integrated into the web application
  level: medium
  tags:
  - attack.t1190
  - attack.command_and_control
id: 760c8655-0b72-5535-a810-45ebd7d937ee
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230803.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fbab64fc-3cf7-5a25-8878-69ca82b866bf/proself-auth-bypass-rce-exploited-in-japan.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup