Spring4Shell vulnerability

[GerhardSA]

Is this something we should worry about?

https://venturebeat.com/2022/03/30/spring4shell-vulnerability-likely-to-affect-real-world-apps-analy... 

CVE-2022-22965 

[angelborroy]

We're still evaluating the impact of this vulnerability in the ACS Stack.

It's highly unlikely that vanilla Alfresco deployment is vulnerable to this CVE, but we'll be publishing an official statement related to this topic in the next days.

[GerhardSA]

Thank you for the quick reply. We'll be waiting for the official statement.

[aitseitz]

The Spring Frameworks vulnerabilities CVE-2022-22963 and CVE-2022-22965 requires special preconditions
(see https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)
to be exploited. To my current knowledge, a class loading mechanism in Tomcat Common Logging allows the exploitation of this "Spring4Shell" vulnerability in the first place.

Until Alfresco has evaluated 

CVE-2022-22963 (Spring Cloud Function)

CVE-2022-22965 (Spring MVC and Spring WebFlux)

in its inernal jira MNTs and provide a HF for all its Spring Framework related products, we could react by:

UPGRADING TOMCAT!

New Tomcat versions are now available for download:

Tomcat 9 (for ACS 7.0-ACS7.2):
https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.62/bin/apache-tomcat-9.0.62.tar.gz

Tomcat 8 (for ACS 6.0-ACS6.2):
https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.78/bin/apache-tomcat-8.5.78.tar.gz

With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via Spring4Shell vulnerability and as far as I know secures Alfresco Content Services against this exploit.

More information:
https://tomcat.apache.org/tomcat-10.0-doc/changelog.html#Tomcat_10.0.20_(market)
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.62_(remm)
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.78_(market)

Additionally the National Cyber Security Centrum has published  a compilation on Spring4Shell,
https://github.com/NCSC-NL/spring4shell
with a list of known vulnerable and non-vulnerable software, as well as detection tools and vulnerability scanners.

Please check your own extensions / applications (*.war) running in the same Tomcat as Alfresco Content Service for the "Spring4Shell" vulnerability!