Proself Enterprise/Standard/Gateway/Mail Sanitize Edition XML External Entity (XXE) Vulnerability (CVE-2023-45727)
Executive & SecOps Summary
SECOPS ASSESSMENTProself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier
A remote unauthenticated attacker can read arbitrary system files and sensitive account credentials by sending specially crafted XML requests
Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches immediately by upgrading to the following versions or later:
- Proself Enterprise/Standard Edition: Ver5.63 or later
- Proself Gateway Edition: Ver1.66 or later
- Proself Mail Sanitize Edition: Ver1.09 or later
Example commands to stop, update, and restart the Proself service on Linux:
# 1. Stop the running Proself service
sudo systemctl stop proself
# 2. Extract the latest patch package
tar -zxvf proself_patch_latest.tar.gz
cd proself_patch_dir
# 3. Execute the update script and restart the service
sudo ./update.sh
sudo systemctl start proself2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, configure Web Application Firewall (WAF) rules or reverse proxy filters to block incoming XML payloads containing external entity declarations (<!ENTITY, SYSTEM, PUBLIC). Below is an example configuration for Nginx:
# Block XXE injection patterns at the reverse proxy level
server {
listen 80;
server_name proself.local;
location / {
# Reject requests containing XML external entity declarations
if ($request_body ~* '(<!ENTITY|SYSTEM|PUBLIC)') {
return 403 'XXE Attack Blocked';
}
proxy_pass http://127.0.0.1:8080;
}
}3. Log Audit & IoC Verification Commands
Search the Proself application and access logs for potential exploitation attempts using the following commands:
# Search for external entity declarations and file protocol schemes in logs
grep -riE '(SYSTEM|PUBLIC|file://|gopher://|http://)' /usr/local/proself/logs/
# Verify the currently installed Proself version
cat /usr/local/proself/webapps/proself/WEB-INF/conf/version.propertiesBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-45727) is an XML External Entity (XXE) vulnerability in the Proself file-sharing solution developed by Northgrid. The root cause lies in the insecure configuration of the XML parser within the application, which fails to restrict or disable external entity references (CWE-611). This allows unauthenticated remote attackers to force the server to resolve external URIs defined within incoming XML payloads.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request containing a malicious XML payload to an endpoint that processes XML data. By defining an external entity pointing to local system resources (e.g., <!ENTITY xxe SYSTEM 'file:///etc/passwd'>), the attacker forces the vulnerable XML parser to read the contents of the specified file and return it in the application response or exfiltrate it via an Out-of-Band (OOB) channel.
3. Infrastructure & Business Impact
Since this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it represents a highly critical threat with active exploitation in the wild. Successful exploitation can lead to the exposure of highly sensitive configuration files, database credentials, and system user accounts. This exposure can serve as a stepping stone for lateral movement, privilege escalation, and full infrastructure compromise.
Official Vendor Advisories & References
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
Frequently Asked SecOps Questions (CVE-2023-45727)
FAQQ1. How critical is CVE-2023-45727 and is it actively exploited in the wild?
CVE-2023-45727 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 4.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-45727?
Primary impacted vendors include northgrid across proself. Scope summary: Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier
Q3. What temporary mitigations or workarounds exist for CVE-2023-45727 before patching?
[Mitigation] Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-45727
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (northgrid)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.