North Grid · Proself
The Proself product from North Grid contains an XML External Entity (XXE) flaw in its Enterprise/Standard Edition (up to and including Ver5.62), Gateway Edition (up to and including Ver1.65), and Mail Sanitize Edition (up to and including Ver1.08), where XML input is parsed without restricting external entity references. A remote attacker who has no authentication and needs no user interaction can send a specially crafted request containing malformed XML to read arbitrary files on the server, including files containing account information.
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
First seen exploited 11 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
remote unauthenticated attack against public-facing web app
allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks
XXE reads arbitrary server files
arbitrary files on the server containing account information may be read
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2023-45727 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461), Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997), were abused in the wild.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.