Dear partners,
On March 29, 2022, a new security vulnerability was first reported, which can be exploited by a remote attacker on certain configurations to gain complete control over the system.
Although less widespread than Log4j was back then, you should still check your own systems as well as those of your customers!
Which systems are affected?
The current security vulnerability affects the (open-source) Java framework “Spring” and is a remote code execution with a CVSSv3 score of 9.8!
The following criteria must all be met in order for the loophole to be exploited:
- JDK9 or higher in use
- Apache Tomcat (not Spring Boot*) in use
- Spring uses applications created as WAR files in versions earlier than “5.3.18” or “5.2.20”.
- There is a dependency on “spring-webmvc” or “spring-webflux”
*For safety reasons, it is recommended to also update Spring Boot.
Several VMware products are also affected; you can find an overview including mitigation tips here:
https://www.vmware.com/security/advisories/VMSA-2022-0010.html
What can I do?
Affected systems should be checked and patched as soon as possible, or they must go offline.
An update to Spring 5.3.18 or 5.2.20 respectively closes this gap.
If that is not possible, Tomcat can alternatively be updated; versions 10.0.20, 9.0.62 and 8.5.78 also block the exploitation.
A downgrade to Java 8 is also possible, but only really advisable and useful in an emergency.
For further information, the following links may be helpful:
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
https://github.com/NCSC-NL/spring4shell
Are the SYNAXON Services systems affected?
Our internal systems for delivering managed services have been reviewed by our IT department and are fully patched. We were able to confirm that the vulnerability was not actively exploited.
Some of our solution providers have already responded; so far, the gap has not been found anywhere.
An overview of the currently available statements can be found below:
- Monitoring & Management (N-able): https://status.n-able.com/2022/04/04/n-able-and-spring4shellcve-2022-22965/
- Managed Endpoint Protection (ESET): https://forum.eset.com/topic/31966-spring4shell-rce-vulnerability-cve-2022-22965-eset-protect-webconsole-component/
What happens next?
If we have any further updates on this topic, we will update this post accordingly.
I still have questions…
No problem at all. We've summarized here how you can get a solution from us as quickly as possible: https://synaxon-services.com/de/blog/2021/10/22/wie-funktioniert-unser-support
You can also easily book an appointment with our technical team. Please include your ticket number or the reason for the appointment in the comments.