CVE-2023-45727

What it actually does

This is a remotely reachable XML External Entity (XXE) vulnerability in North Grid Proself products. An unauthenticated attacker can submit specially crafted XML containing external entity declarations to an endpoint that parses XML. If the parser resolves those entities, it can read local server files and include their contents in an application response or error path. The primary impact is high-confidence disclosure of sensitive files, including account information, configuration data, credentials, keys, and other readable files available to the Proself application process. The described flaw does not directly provide code execution or data modification, but stolen secrets can enable follow-on compromise.

Why it matters to the business

Successful exploitation can expose user account information and application secrets from file transfer infrastructure, creating risk of account takeover, unauthorized access to shared files, data breach notifications, regulatory exposure, and operational disruption while credentials are rotated and systems are investigated. This vulnerability is listed in CISA KEV and has been observed exploited in the wild, with a federal remediation due date of 2024-12-24, so internet-facing Proself deployments should be treated as high-priority even though the EPSS score is moderate. The supplied affected package list appears inconsistent with the Proself product description and should be validated against vendor advisories before relying on package inventory alone.

How an attack unfolds

An attacker first identifies an exposed Proself Enterprise, Standard, Gateway, or Mail Sanitize instance running a vulnerable version. They then locate an unauthenticated or pre-authentication request path that accepts XML input and send a crafted XML document containing a DOCTYPE declaration and external entity reference such as a file:// URI. The vulnerable XML parser resolves the external entity using the privileges of the application process. The attacker causes the resolved content to be reflected in the HTTP response, included in an XML parsing error, or delivered through an out-of-band callback if supported by the parser behavior. They repeat the request for high-value local files such as account data, application configuration, credential stores, and keys. With recovered credentials or secrets, the attacker may authenticate to the application, access stored files, impersonate users, or pivot to adjacent services.

How to fix it

Upgrade affected North Grid Proself installations immediately: Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier should be updated to vendor-fixed releases newer than those vulnerable versions. If an advisory or package feed in use lists fixed OS package versions, validate applicability because the provided fixed-version list appears to reference Linux kernel packages rather than Proself application versions; do not treat unrelated kernel updates as sufficient remediation for this Proself XXE issue. As defense in depth, disable XML external entity resolution and DTD processing where configurable, restrict outbound HTTP/DNS from the application server, limit the application process file permissions, place Proself behind authentication or VPN where feasible, and monitor for suspicious XML payloads. After patching, rotate credentials, API keys, tokens, and application secrets that may have been readable by the Proself process, especially if the instance was internet-facing before remediation.

How to confirm the fix worked

Confirm the installed Proself product and version from the application administration interface, vendor-provided version command, package metadata, or deployed application files, and verify it is newer than the vulnerable product thresholds. Confirm the vendor patch notes explicitly address CVE-2023-45727 or XXE handling. Test exposure in a controlled manner by submitting a benign XXE payload that references a non-sensitive local marker file or an internal canary URL and confirm that external entities are not resolved, no file contents are returned, and no outbound DNS/HTTP callback is generated. Review XML parser configuration to ensure DOCTYPE declarations, external general entities, external parameter entities, and external DTD loading are disabled. Validate network egress controls by confirming the Proself host cannot make arbitrary outbound DNS/HTTP requests to unapproved destinations.

Typical attack path

1. Scan for internet-facing North Grid Proself servers and fingerprint product/version information.
2. Identify XML-processing endpoints reachable without authentication or before full authorization is enforced.
3. Send a crafted XML request containing a DOCTYPE declaration, ENTITY definition, and external reference to a local file or attacker-controlled URL.
4. Observe whether local file contents are returned in the HTTP response, parsing error, or out-of-band DNS/HTTP interaction.
5. Extract sensitive files such as account databases, application configuration, password hashes, tokens, or private keys readable by the application process.
6. Use recovered credentials or secrets to access Proself, retrieve shared files, impersonate users, or expand access to related systems.
7. Cover tracks by blending requests with normal web traffic or limiting probing to high-value files.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, reverse proxy/WAF logs, Proself application logs, XML parser errors, EDR file access telemetry, DNS logs, proxy logs, and firewall egress records. Look for unauthenticated POST or XML-bearing requests containing DOCTYPE, ENTITY, SYSTEM, PUBLIC, file://, expect://, jar:, gopher:, or references to sensitive local files. Pay special attention to requests that produced 200, 400, or 500 responses with unusual response sizes, XML parsing exceptions, or repeated probes for different file paths. Investigate outbound DNS or HTTP requests initiated by the Proself server to unfamiliar domains immediately after XML requests, which may indicate out-of-band XXE exfiltration. In application and OS telemetry, look for the Proself process reading files outside its normal application directories, especially account stores, configuration files, password files, SSH keys, TLS keys, or cloud credential paths. After suspected exploitation, correlate with authentication logs for unusual successful logins, administrator activity, mass file downloads, newly created accounts, changed email addresses, or access from unfamiliar geographies and autonomous systems.

• <!DOCTYPE
• <!ENTITY
• SYSTEM "file://
• SYSTEM 'file://
• PUBLIC "-//
• file:///etc/passwd
• file:///etc/shadow
• file:///etc/hosts
• file:///proc/self/environ
• file:///proc/self/cmdline
• file:///proc/self/cwd
• file:///proc/self/root
• file:///var/log/
• file:///home/
• file:///root/.ssh/id_rsa
• file:///root/.ssh/authorized_keys
• file:///etc/ssh/ssh_host_rsa_key
• file:///etc/ssh/ssh_host_ecdsa_key
• file:///etc/ssh/ssh_host_ed25519_key
• file:///etc/ssl/private/
• file:///var/proself/
• file:///usr/local/proself/
• file:///opt/proself/
• file:///WEB-INF/web.xml
• /WEB-INF/classes/
• /WEB-INF/lib/
• java.io.FileNotFoundException
• org.xml.sax.SAXParseException
• DOCTYPE is disallowed
• External Entity
• External entity
• xxe
• SYSTEM "http://
• SYSTEM 'http://
• SYSTEM "https://
• SYSTEM 'https://
• SYSTEM "ftp://
• SYSTEM 'ftp://

What your security team should do

• Immediately inventory all Proself Enterprise/Standard, Gateway, and Mail Sanitize deployments, prioritizing internet-facing systems.
• Patch or upgrade all vulnerable Proself versions; treat CISA KEV status and known in-the-wild exploitation as the urgency driver.
• If immediate patching is not possible, restrict access to trusted networks, disable XML external entity/DTD processing if configurable, and block unnecessary outbound traffic from Proself servers.
• Hunt historical web access logs and application logs for XXE payload markers such as DOCTYPE, ENTITY, SYSTEM, file://, and references to sensitive local paths.
• Review DNS, proxy, firewall, and EDR telemetry for unexpected outbound callbacks from Proself servers around suspicious XML requests.
• Rotate Proself user credentials, service account passwords, tokens, and application secrets if exploitation is suspected or if logs are unavailable.
• Check for unauthorized Proself logins, unusual file downloads, account changes, new administrator users, or access from unfamiliar IP addresses after possible exploitation windows.
• Validate advisory data quality: reconcile the supplied Linux kernel package fixed versions with the actual Proself vendor advisory before marking application risk as remediated.