CVE-2023-45727
North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability
Description
CVE-2023-45727 is a high-severity XML External Entity (XXE) injection vulnerability in North Grid Proself, a Japanese enterprise file sharing platform. The flaw affects Proself Enterprise/Standard Edition version 5.62 and earlier, Gateway Edition version 1.65 and earlier, and Mail Sanitize Edition version 1.08 and earlier. A remote, unauthenticated attacker can exploit the vulnerability by sending specially crafted requests containing malformed XML data to read arbitrary files on the server, including those containing account information and sensitive credentials. With a CVSS v3.1 base score of 7.5 and a network-accessible attack vector requiring no authentication or user interaction, this vulnerability enables significant data exfiltration. CISA has added CVE-2023-45727 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 24, 2024, and its EPSS score of 21.05% at the 95.5th percentile indicates a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| northgrid | proself | < 1.09; < 1.66; < 5.63 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://jvn.jp/en/jp/JVN95981460/(Third Party Advisory)
- https://www.proself.jp/information/153/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45727(US Government Resource)
Weakness Type
CWE-611: XML External Entity (XXE) Injection
CVE-2023-45727 is classified under CWE-611 (Improper Restriction of XML External Entity Reference), commonly known as XXE injection. This weakness occurs when an XML parser processes XML input that includes a reference to an external entity, and the application does not properly restrict or disable the resolution of these external references. In Proself's request handling, the XML parser is configured to resolve external entities, allowing an attacker to craft XML payloads that reference local files on the server using file:// URI schemes or other protocol handlers. The parser follows these references and includes the file contents in its response, enabling the attacker to read sensitive data from the server filesystem without authentication.
Impact Analysis
The impact of CVE-2023-45727 is concentrated on confidentiality, which is rated as high. The XXE injection allows unauthenticated attackers to read arbitrary files from the Proself server, including account databases, configuration files, credential stores, and any documents managed by the file sharing platform. Proself is widely used in Japanese enterprises and government organizations for secure file sharing, meaning the exposed data may include highly sensitive business documents, personal information, and authentication credentials.
Integrity and availability are not directly impacted according to the CVSS vector (I:N/A:N), as the vulnerability is limited to file reading through the XML parser. However, the exposure of credentials and configuration data through XXE enables secondary attacks that can compromise both integrity and availability. An attacker who obtains administrator credentials from the server can gain full control over the Proself instance and all shared files.
The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L), making automated exploitation straightforward. The EPSS score of 21.05% at the 95.5th percentile confirms high exploitation probability. Proself has been targeted by advanced persistent threat groups, with Japan's CERT/CC issuing a JVN advisory documenting the vulnerability and exploitation activity.
Exploit Maturity
CVE-2023-45727 demonstrates high exploit maturity, confirmed by CISA's inclusion in the Known Exploited Vulnerabilities catalog. The EPSS score of 21.05% at the 95.5th percentile places it among the top 5% of all vulnerabilities by exploitation probability.
The North Grid Proself advisory provides the official vendor disclosure, and Japan's JVN has published an independent advisory documenting the vulnerability. Proself has been a target for advanced persistent threat groups operating in the Asia-Pacific region, who have exploited XXE and other vulnerabilities in the platform to conduct espionage operations and data theft campaigns against Japanese government agencies and enterprises. While CISA has not confirmed a direct ransomware association for this CVE, the demonstrated interest from APT groups and the straightforward nature of XXE exploitation make ongoing exploitation highly likely. The vulnerability's value lies in its ability to silently exfiltrate sensitive data without leaving obvious traces in application logs.
Remediation
-
Update Proself immediately to patched versions: Enterprise/Standard Edition to version 5.63 or later, Gateway Edition to version 1.66 or later, and Mail Sanitize Edition to version 1.09 or later. The North Grid advisory provides download links and upgrade instructions for each product edition.
-
Restrict network access to the Proself web interface as a compensating control. Limit access to trusted IP ranges or require VPN connectivity for remote users. Deploy a web application firewall (WAF) with XML parsing protection rules to filter malicious XML payloads before they reach the application.
-
Audit server files and logs for evidence of exploitation. Review web server access logs for unusual requests containing XML payloads or references to sensitive file paths. Check whether account databases, configuration files, or credential stores may have been accessed. Pay particular attention to requests from IP addresses associated with known APT infrastructure.
-
Reset all credentials stored on or managed by the Proself server. This includes administrator and user account passwords, integration credentials, API keys, and any shared secrets. If the server was exposed to the internet while running a vulnerable version, assume all stored credentials have been compromised.
-
Implement defense-in-depth by configuring the application server to disable XML external entity resolution at the parser level, if possible. This provides protection against future XXE vulnerabilities even if the application code fails to properly restrict XML processing.
Technical Details
CVE-2023-45727 is an XML External Entity (XXE) injection vulnerability in North Grid Proself file sharing platform. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible attack with no prerequisites that results in high confidentiality impact.
The vulnerability exists in Proself's request processing logic, where user-supplied XML data is parsed by an XML processor that has external entity resolution enabled. When the application receives a request containing specially crafted XML with an external entity declaration (such as <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>), the XML parser resolves the entity by reading the referenced file from the local filesystem and incorporating its contents into the parsed XML document.
The attacker exploits this by embedding file:// URI references to sensitive files in XML payloads sent to the Proself application. Common targets include operating system credential files, application configuration files containing database credentials, Proself's own account database, and any documents stored on the server's filesystem accessible to the application process.
The scope is unchanged (S:U) as the vulnerability operates within the Proself application's security context. The impact is limited to confidentiality (C:H) with no direct integrity or availability impact, as XXE in this case enables file reading but not file writing or denial of service. However, the data obtained through XXE — particularly credentials and configuration information — frequently enables secondary attacks with broader impact.
Affected versions include Proself Enterprise/Standard Edition 5.62 and earlier, Gateway Edition 1.65 and earlier, and Mail Sanitize Edition 1.08 and earlier. The fix in subsequent versions disables external entity resolution in the XML parser, preventing external entity references from being processed.
Frequently Asked Questions
What is CVE-2023-45727?
CVE-2023-45727 is an XML External Entity (XXE) injection vulnerability in North Grid Proself, a Japanese enterprise file sharing platform. It allows unauthenticated remote attackers to read arbitrary files from the server by sending specially crafted XML requests.
Which Proself editions and versions are affected?
Three Proself product editions are affected: Enterprise/Standard Edition version 5.62 and earlier, Gateway Edition version 1.65 and earlier, and Mail Sanitize Edition version 1.08 and earlier. Organizations should upgrade to versions 5.63, 1.66, and 1.09 respectively.
What data can be exposed through CVE-2023-45727?
The XXE vulnerability allows reading any file accessible to the Proself application process on the server. This typically includes user account databases, configuration files with database credentials, SSL certificates, and any documents stored on the file sharing platform.
Who has been exploiting CVE-2023-45727?
Advanced persistent threat groups operating in the Asia-Pacific region have been observed exploiting Proself vulnerabilities to target Japanese government agencies and enterprises. CISA has confirmed active exploitation by adding the CVE to the Known Exploited Vulnerabilities catalog.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.