Re: Spring4Shell vulnerability

angelborroy — Fri, 01 Apr 2022 13:22:45 GMT

We're still evaluating the impact of this vulnerability in the ACS Stack.

It's highly unlikely that vanilla Alfresco deployment is vulnerable to this CVE, but we'll be publishing an official statement related to this topic in the next days.

Re: Spring4Shell vulnerability

GerhardSA — Fri, 01 Apr 2022 13:36:36 GMT

Thank you for the quick reply. We'll be waiting for the official statement.

Re: Spring4Shell vulnerability

aitseitz — Mon, 04 Apr 2022 14:59:31 GMT

The Spring Frameworks vulnerabilities CVE-2022-22963 and CVE-2022-22965 requires special preconditions
(see https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)
to be exploited. To my current knowledge, a class loading mechanism in Tomcat Common Logging allows the exploitation of this "Spring4Shell" vulnerability in the first place.

Until Alfresco has evaluated

CVE-2022-22963 (Spring Cloud Function)

CVE-2022-22965 (Spring MVC and Spring WebFlux)

in its inernal jira MNTs and provide a HF for all its Spring Framework related products, we could react by:

UPGRADING TOMCAT!

New Tomcat versions are now available for download:

Tomcat 9 (for ACS 7.0-ACS7.2):
https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.62/bin/apache-tomcat-9.0.62.tar.gz

Tomcat 8 (for ACS 6.0-ACS6.2):
https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.78/bin/apache-tomcat-8.5.78.tar.gz

With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via Spring4Shell vulnerability and as far as I know secures Alfresco Content Services against this exploit.

More information:
https://tomcat.apache.org/tomcat-10.0-doc/changelog.html#Tomcat_10.0.20_(market)
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.62_(remm)
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.78_(market)

Additionally the National Cyber Security Centrum has published a compilation on Spring4Shell,
https://github.com/NCSC-NL/spring4shell
with a list of known vulnerable and non-vulnerable software, as well as detection tools and vulnerability scanners.

Please check your own extensions / applications (*.war) running in the same Tomcat as Alfresco Content Service for the "Spring4Shell" vulnerability!

topic Re: Spring4Shell vulnerability in Alfresco Forum

Spring4Shell vulnerability

Re: Spring4Shell vulnerability

Re: Spring4Shell vulnerability

Re: Spring4Shell vulnerability