A zero-day exploit affecting the Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions was made public on March 30, 2022, allowing an unauthenticated attacker to execute arbitrary code on the target system.
Citrix recommends that customers hosting affected web applications follow Spring’s recommendations. In addition, Citrix Web App Firewall (WAF) customers should consider the following recommendations to improve the security of their applications from this vulnerability.
The Citrix research team has released updated Citrix WAF signatures designed to mitigate in part the CVE-2022-22963, CVE-2022-22965 vulnerability. If you are using any of these Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions), Citrix strongly recommends that you download the signatures version 79 and apply to your Citrix WAF deployments as an additional layer of protection for your applications. Signatures are compatible with the following software versions of Citrix Application Delivery Controller (ADC) 11.1, 12.0, 12.1, 13.0 and 13.1. Please note, versions 11.1 and 12.0 are end of life.
Citrix ADC Produkte sind selber nicht von der Sicherheitslücke betroffen.
Für alle Kunden, welche WAF nicht im Einsatz haben, gibt es auch eine Empfehlung seitens Citrix, die Sicherheitslücke mittels Responder Policy zu minimieren:
Citrix ADC Standard and Advanced edition customers, as well as Premium edition customers who do not have WAF signatures enabled, can use responder policies for protection as shown below. Please bind the responder policy to the appropriate bind point (vserver or global).
add responder policy mitigate_cve_2022_22963_22965 q^(HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.
CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ DROP
Citrix recommends that Citrix WAF customers use the latest signature version, enable signatures auto-update, and subscribe to receive signature alert notifications. Citrix will continue to monitor this dynamic situation and update as new mitigations become available.
If any of your application availability is inadvertently impacted due to false positives resulting from above mentioned mitigation policies, Citrix recommends the following modifications to the policy. Please note that any end point covered by the exception_list may expose those assets to the risks from CVE-2022-22963, CVE-2022-22965.
Mehr Informationen sind hier zu finden:
https://www.citrix.com/blogs/2022/04/01/guidance-for-reducing-spring4shell-security-vulnerability-risk-with-citrix-waf/
Release Notes der WAF Signaturen:
https://docs.citrix.com/en-us/citrix-adc/current-release/application-firewall/signature-alerts/signature-update-version-79.html
Bei Fragen zum Update und dem Einsatz der Citrix ADC WAF bzw. der Signaturen, wenden Sie sich an unseren Support.