Spring4Shell vulnerability

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-01-2022 09:13 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-01-2022 09:22 AM
We're still evaluating the impact of this vulnerability in the ACS Stack.
It's highly unlikely that vanilla Alfresco deployment is vulnerable to this CVE, but we'll be publishing an official statement related to this topic in the next days.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-01-2022 09:36 AM
Thank you for the quick reply. We'll be waiting for the official statement.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-04-2022 10:59 AM
The Spring Frameworks vulnerabilities CVE-2022-22963 and CVE-2022-22965 requires special preconditions
(see https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)
to be exploited. To my current knowledge, a class loading mechanism in Tomcat Common Logging allows the exploitation of this "Spring4Shell" vulnerability in the first place.
Until Alfresco has evaluated
in its inernal jira MNTs and provide a HF for all its Spring Framework related products, we could react by:
UPGRADING TOMCAT!
New Tomcat versions are now available for download:
Tomcat 9 (for ACS 7.0-ACS7.2):
https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.62/bin/apache-tomcat-9.0.62.tar.gz
Tomcat 8 (for ACS 6.0-ACS6.2):
https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.78/bin/apache-tomcat-8.5.78.tar.gz
With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via Spring4Shell vulnerability and as far as I know secures Alfresco Content Services against this exploit.
More information:https://tomcat.apache.org/tomcat-10.0-doc/changelog.html#Tomcat_10.0.20_(market)
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.62_(remm)
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.78_(market)
Additionally the National Cyber Security Centrum has published a compilation on Spring4Shell,
https://github.com/NCSC-NL/spring4shell
with a list of known vulnerable and non-vulnerable software, as well as detection tools and vulnerability scanners.
Please check your own extensions / applications (*.war) running in the same Tomcat as Alfresco Content Service for the "Spring4Shell" vulnerability!
