CVE-2023-45727: North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

CVE-2023-45727 is an improper restriction of XML External Entity (XXE) reference vulnerability in North Grid Proself products. It affects Proself Enterprise/Standard, Gateway, and Mail Sanitize and allows a remote, unauthenticated attacker to conduct an XXE attack. For organizations running these components, the issue matters because unauthenticated remote access to XXE flaws can expose internal data or enable further reconnaissance; defenders should treat it as a priority for inventory and remediation while confirming all details against the vendor advisory.

How it works

The vulnerability is classified as CWE-611: Improper Restriction of XML External Entity Reference. In products that parse XML input without adequately disabling external entity resolution, an attacker can supply crafted XML that references external entities. According to the CISA summary, a remote unauthenticated attacker can abuse this in North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize to conduct an XXE attack. Exact request paths, payloads, or resulting impact (such as file disclosure or server-side request forgery) are not detailed in the provided facts and must be confirmed against the vendor advisory. In general for this weakness class, successful XXE can let an attacker read local files the application process can access, interact with internal network resources, or cause denial-of-service conditions through entity expansion.

Am I affected? How to find it in your systems

North Grid Proself is typically deployed as file-sharing, gateway, or mail-sanitization infrastructure, often in enterprise environments that handle document exchange or email filtering. Inventory any instances of Proself Enterprise/Standard, Gateway, or Mail Sanitize. Check software inventories, configuration management databases, and network asset scanners for hosts or virtual appliances running these products. Because specific vulnerable version ranges are not supplied in the facts, compare installed builds and configurations directly against the vendor advisory. Look for XML-processing endpoints that accept unauthenticated or lightly authenticated input, such as upload, import, or gateway interfaces.

For signs of exploitation, review application and web-server logs for unusual XML payloads containing entity declarations (for example, references to external DTDs or SYSTEM identifiers), unexpected outbound connections from the Proself host, or anomalous file-access patterns. Network telemetry showing connections from the Proself system to unexpected internal or external destinations after XML submissions can also indicate abuse. Absence of such indicators does not prove safety; proactive inventory remains essential.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation instructions for North Grid Proself as directed in the official advisory. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. After applying the update, verify that XML parsers in the product no longer resolve external entities by default and re-test any custom integrations that feed XML into the system.

Beyond the patch, harden the broader class of XXE risk: ensure any remaining XML-processing components disable external entity resolution, DTD processing, and entity expansion; run the service under least-privilege accounts that cannot read sensitive files; and restrict outbound network access from the Proself hosts so that even a successful XXE cannot reach arbitrary internal or external resources.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls. Segment Proself Enterprise/Standard, Gateway, and Mail Sanitize instances onto isolated network segments with strict ingress filtering so that only required clients can reach the XML-handling interfaces. If a web application firewall or reverse proxy sits in front of the product, enable rules that inspect and block XML containing external entity declarations or DOCTYPE statements (virtual patching). Disable any non-essential features that accept XML input if the product configuration allows it. Increase monitoring: alert on XML submissions that contain entity references, on unexpected outbound connections originating from the Proself hosts, and on process-level file reads outside normal application directories. These steps do not eliminate the vulnerability but lower the likelihood of successful remote unauthenticated exploitation.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to data exposure or further compromise. Although ransomware use is not documented for this CVE, treat any confirmed XXE activity as a potential breach precursor. Review access logs, check for unauthorized file access or data exfiltration, and follow your incident-response plan. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information associated with your organization already appear in public breach corpora.