Citrix Security Advisory for CVE-2022-22963 and CVE-2022-22965

The Citrix research team has released updated Citrix WAF signatures designed to mitigate in part the CVE-2022-22963, CVE-2022-22965 vulnerability. If you are using any of these Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions), Citrix strongly recommends that you download the signatures version 79 and apply to your Citrix WAF deployments as an additional layer of protection for your applications. Signatures are compatible with the following software versions of Citrix Application Delivery Controller (ADC) 11.1, 12.0, 12.1, 13.0 and 13.1. Please note, versions 11.1 and 12.0 are end of life. Learn more about the release life cycle.

Signature rule CVE ID Description
18959 CVE-2022-22965 WEB-MISC VMware Spring4Shell, SpringSource Spring Framework class.classloader RCE attempt
999005 CVE-2022-22963 WEB-MISC Spring Cloud Function – Code Injection Vulnerability (CVE-2022-22963)

If you are already using Citrix WAF with signatures with auto-update feature enabled, you may follow these steps after verifying that the signature version is at least version 79.

  1. Search your signatures for Spring LogString
  2. Select the results with ID 999005, 999004 and 18959
  3. Choose “Enable Rules” and click OK

Click image to view larger.

Citrix ADC Standard and Advanced edition customers, as well as Premium edition customers who do not have WAF signatures enabled, can use responder policies for protection as shown below. Please bind the responder policy to the appropriate bind point (vserver or global).

add responder policy mitigate_cve_2022_22963_22965 q^(HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ DROP

Citrix recommends that Citrix WAF customers use the latest signature version, enable signatures auto-update, and subscribe to receive signature alert notifications. Citrix will continue to monitor this dynamic situation and update as new mitigations become available.

If any of your application availability is inadvertently impacted due to false positives resulting from above mentioned mitigation policies, Citrix recommends the following modifications to the policy. Please note that any end point covered by the exception_list may expose those assets to the risks from CVE-2022-22963, CVE-2022-22965.

1) Modifications to Responder Policy

add policy patset exception_list# (Example: bind policy patset exception_list "/exception_url")set responder policy mitigate_cve_2022_22963_22965 -rule q^HTTP.REQ.URL.CONTAINS_ANY("exception_list").NOT && (HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ 

2) Modifications to WAF Policy

add policy patset exception_list# (Example: bind policy patset exception_list "/exception_url")Prepend the existing WAF policy with HTTP.REQ.URL.CONTAINS_ANY("exception_list").NOT# (Example : set appfw policy my_WAF_policy q^HTTP.REQ.URL.CONTAINS_ANY("exception_list").NOT && <existing rule>^

Related:

  • No Related Posts

Leave a Reply