topic Re: Alfresco Content Services & Alfresco Process Services : Information on "Spring4Shell" Spring Framework RCE vulnerability? in Alfresco Forum

Alfresco Content Services & Alfresco Process Services : Information on "Spring4Shell" Spring Framework RCE vulnerability?

mne — Mon, 04 Apr 2022 14:27:00 GMT

Is Hyland able to provide any information on whether ACS, APS or any related product are impacted by the "Spring4Shell" Spring Framework RCE vulnerability?

Announcement from Spring : https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Many thanks in advance for your feedback

Regards !

Re: Alfresco Content Services & Alfresco Process Services : Information on "Spring4Shell" Spring Framework RCE vulnerability?

angel-borroy — Mon, 04 Apr 2022 14:34:21 GMT

Hi, Mickael.

We're still evaluating detailed impact of this vulnerability.

Attacked libraries and versions are used in some of our products, however this is not the only condition to met.

We sill provide an official communication later this week, but it looks like the impact will be very low or none at all.

Regards

Re: Alfresco Content Services & Alfresco Process Services : Information on "Spring4Shell" Spring Framework RCE vulnerability?

AlfSup — Wed, 28 Sep 2022 08:35:29 GMT

Hi Angel,

Do you have any recommendations/updates concerning this issue ?

Best regards,

Marie Magnier.

Re: Alfresco Content Services & Alfresco Process Services : Information on "Spring4Shell"

aitseitz — Fri, 11 Apr 2025 21:56:44 GMT

@Atol Support Team:

The official Information can be found here:

Alfresco Process Services (APS) is impacted from "Spring4Shell"

--> Upgrade to at least APS version 2.3.1

Alfresco Content Services (ACS) is NOT impacted from "Spring4Shell" in its default configuration.

--> I fixed the security issue at the customer by upgrading the Tomcat version and can recommend to do so as well.See: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via the Spring4Shell vulnerability and secures Alfresco Content Services against this exploit.

More information:https://tomcat.apache.org/tomcat-10.0-doc/changelog.html#Tomcat_10.0.20_(market) ;https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.62_(remm) ;https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.78_(market)

To check your installed tomcat version:

/content-services/tomcat/bin$ ./version.sh | grep version

Additional hint

In case you've modified Tomcat to use Log4j2 instead of Apache Commons Logging, for a unifom logging format, I can highly recommend to upgrade the log4j2 library > 17.2 to prevent "Log4Shell" security exploit as well!

Additional information to "Log4Shell" from Alfresco

https://hub.alfresco.com/t5/alfresco-content-services-blog/cve-2021-44228-related-to-apache-log4j-security-advisory/ba-p/310717

best regards

Alex