Spring4Shell in containers, should you be worried?

Spring4Shell is the brother from another mother of Log4j. Vulnerabilities seem to come in bunches; if you see one, you should be worried because it is a sign that there are probably related ones lurking nearby. Getting rid of Log4j was a huge challenge in late 2021 but it looks like it wasn’t a one-time fix. The same challenge is posed again by another vulnerability called Spring4Shell. This time the popular Spring Core Java framework is affected. It is used by many businesses and even heavily relied on by the fintech industry to build Java web applications. Depending on the configuration, attacker can exploit this vulnerability by sending a crafted HTTP request to a vulnerable system which then allows an attacker to execute malicious code on the target system. The good thing is that there was already a patch released but the real challenge is identifying the repositories, containers, and applications that are affected. This is the part that is really worrying. Handling vulnerabilities like this inefficiently can cost businesses a lot of time and resources.

How to Handle Vulnerabilities that are Inside Containers

The key to handling vulnerabilities efficiently is to know what’s inside your software and to understand where it came from and where the software is running. Containers add another layer of complexity to those questions. In this blog we present a 4 step approach using Codenotary Cloud and the guidelines of the SLSA Framework (Supply Chain Levels for Software Artifacts). SLSA is a framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses, or enterprises. The container image we are using in this blog contains the Spring4shell vulnerability and is based on the Spring4Shell-POC github project.

Documentation of the Build Process
SLSA Level one is about generating metadata on how an artifact was built, including the build process, top-level source, and dependencies. The Codenotary’s VCN command-line tool does exactly that. It is able to notarize files, git commits and container images. Notarizing images will generate that metadata and attach it to the unique hash-value of the notarized asset. It is also possible to generate a SBOM (Software Bill of Materials). SBOMs are like a list of ingredients on food packaging but for software. A very simple but useful concept.

Here’s an Example of notarizing and generating a Bill of Materials with VCN:
vcn notarize --bom docker://vulfocus/spring-core-rce-2022-03-29

Kind: docker
Name: vulfocus/spring-core-rce-2022-03-29:latest
Hash: 82b20510737b27eae390a7ecfa517e9d2eb2e8a5084e02d55bdd402bf28d4ecc
Size: 839 MB
Timestamp: 2022-04-10 11:54:04.010978975 +0000 UTC
Metadata: architecture=”amd64″
docker={
“Architecture”: “amd64”,
“Author”: “”,
“Comment”: “buildkit.dockerfile.v0”,
“Created”: “2022-03-29T12:06:20.080676737Z”,
…

Tamper Resistance of the Build Service
Notarizing through the VCN command-line tool does not only generate metadata about the software artifact. It will also store the metadata attached to the unique hash-value of the asset in immudb. immudb is a tamper-evident open source database developed by Codenotary. immudb ensures that the metadata can’t be changed by any person or process after the fact.

Extra Resistance to Specific Threats
Codenotary Cloud is fully auditable and VCN uses authentication to provide support for the different roles and responsibilities in the DevOps process. Developers can notarize their commits while auditors can authenticate assets and also set them into an “untrusted” state. The login is done via API-Key set as an environment variable:

export VCN_LC_API_KEY=<apikey>
vcn login –lc-host <host-dns-name>

With VCN Auditors are even capable of notarizing and authenticating running containers and its dependencies:

vcn notarize --bom container://springrce

It is possible to search for the affected software by it’s version and set its Status to UNTRUSTED:

vcn authenticate --bom-what-includes --name spring-webmvc --version "<5.3.18"
UID: 1649443904655025803
Kind: java
Name: spring-webmvc
Hash: d62bd1ef6a9aee74557bd59fb96030fd52cf2fc1
Timestamp: 2022-04-08 18:51:44.655025803 +0000 UTC
Metadata: hashtype=”SHA1″
version=”5.3.17″
SignerID: sebastian
Apikey revoked: no
Status: TRUSTED
Included in: container-runtime_springrce 5547604d87c330777990fb15cced288ed6dad0da380a0cdab9800a618d729a5d
vulfocus/spring-core-rce-2022-03-29:latest 82b20510737b27eae390a7ecfa517e9d2eb2e8a5084e02d55bdd402bf28d4ecc
vulfocus/spring-core-rce-2022-03-29:latest 82b20510737b27eae390a7ecfa517e9d2eb2e8a5084e02d55bdd402bf28d4ecc

Take a look at the Codenotary web interface to visualize the work of the command-line tool here.

Highest Levels of Confidence and Trust
Two-person review is an already established best practice before the release of new software. With Codenotary Cloud, this best practice can be implemented more granularly. Reproducible builds, though not strictly required, provide true audibility and reliability benefits. You can see a real life example of this too, just check out our blog about building immudb in a consistent and reproducible way with openSUSE’s Open Build Service.

Conclusion

In this blog we have shown how to handle vulnerabilities by working with guidelines from the SLSA Framework and using Codenotary Cloud. It is straightforward and surprisingly simple once the concept is understood. Vulnerabilities are a constant threat and there are more to come in the future. Log4j and Spring4Shell are huge warning signs. Implementing the SLSA Framework will increase resilience against attacks and vulnerabilities. The tools for that are already on the market. So stop worrying and start implementing.