Alfresco Content Services & Alfresco Process Services : Information on "Spring4Shell" Spring Framework RCE vulnerability?

[mne]

Is Hyland able to provide any information on whether ACS, APS or any related product are impacted by the "Spring4Shell" Spring Framework RCE vulnerability?

Announcement from Spring : https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Many thanks in advance for your feedback

Regards !

[angel-borroy · Accepted solution]

Hi, Mickael.

We're still evaluating detailed impact of this vulnerability.

Attacked libraries and versions are used in some of our products, however this is not the only condition to met.

We sill provide an official communication later this week, but it looks like the impact will be very low or none at all.

Regards

[angel-borroy · Accepted solution]

Hi, Mickael.

We're still evaluating detailed impact of this vulnerability.

Attacked libraries and versions are used in some of our products, however this is not the only condition to met.

We sill provide an official communication later this week, but it looks like the impact will be very low or none at all.

Regards

[AlfSup]

Hi Angel,

Do you have any recommendations/updates concerning this issue ?

Best regards,

Marie Magnier.

[aitseitz · Accepted solution]

@Atol Support Team:

The official Information can be found here:

https://community.hyland.com/connect/hyland-research-and-development/security-advisories/spring-fram...

and
https://community.hyland.com/connect/hyland-research-and-development/security-advisories/spring-fram...

Alfresco Process Services (APS) is impacted from  "Spring4Shell"

--> Upgrade to at least APS version 2.3.1

Alfresco Content Services (ACS) is NOT impacted from "Spring4Shell" in its default configuration.

--> I fixed the security issue at the customer by upgrading the Tomcat version and can recommend to do so as well.
See: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via the Spring4Shell vulnerability and secures Alfresco Content Services against this exploit.

More information:
https://tomcat.apache.org/tomcat-10.0-doc/changelog.html#Tomcat_10.0.20_(market) ;
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.62_(remm) ;
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.78_(market)

To check your installed tomcat version:

/content-services/tomcat/bin$ ./version.sh  | grep version

Additional hint 

In case you've modified Tomcat to use Log4j2 instead of Apache Commons Logging, for a unifom logging format, I can highly recommend to upgrade the log4j2 library > 17.2 to prevent "Log4Shell" security exploit as well!

Additional information to "Log4Shell" from Alfresco

https://community.hyland.com/connect/hyland-research-and-development/security-advisories/CVE-2021-44...

https://hub.alfresco.com/t5/alfresco-content-services-blog/cve-2021-44228-related-to-apache-log4j-se...

best regards

Alex