Spring4Shell in containers, should you be worried?

Spring4Shell is the brother from another mother of Log4j. Vulnerabilities seem to come in bunches; if you see one, you should be worried because it is a sign that there are probably related ones lurking nearby. Getting rid of Log4j was a huge challenge in late 2021 but it looks like it wasn’t a one-time fix. The same challenge is posed again by another vulnerability called Spring4Shell. This time the popular Spring Core Java framework is affected. It is used by many businesses and even heavily relied on by the fintech industry to build Java web applications. Depending on the configuration, attacker can exploit this vulnerability by sending a crafted HTTP request to a vulnerable system which then allows an attacker to execute malicious code on the target system. The good thing is that there was already a patch released but the real challenge is identifying the repositories, containers, and applications that are affected. This is the part that is really worrying. Handling vulnerabilities like this inefficiently can cost businesses a lot of time and resources.

How to Handle Vulnerabilities that are Inside Containers

The key to handling vulnerabilities efficiently is to know what’s inside your software and to understand where it came from and where the software is running. Containers add another layer of complexity to those questions. In this blog we present a 4 step approach using Codenotary Cloud and the guidelines of the SLSA Framework (Supply Chain Levels for Software Artifacts). SLSA is a framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses, or enterprises. The container image we are using in this blog contains the Spring4shell vulnerability and is based on the Spring4Shell-POC github project.

Documentation of the Build Process
SLSA Level one is about generating metadata on how an artifact was built, including the build process, top-level source, and dependencies. The Codenotary’s VCN command-line tool does exactly that. It is able to notarize files, git commits and container images. Notarizing images will generate that metadata and attach it to the unique hash-value of the notarized asset. It is also possible to generate a SBOM (Software Bill of Materials). SBOMs are like a list of ingredients on food packaging but for software. A very simple but useful concept.

Here’s an Example of notarizing and generating a Bill of Materials with VCN:
vcn notarize --bom docker://vulfocus/spring-core-rce-2022-03-29

Kind: docker
Name: vulfocus/spring-core-rce-2022-03-29:latest
Hash: 82b20510737b27eae390a7ecfa517e9d2eb2e8a5084e02d55bdd402bf28d4ecc
Size: 839 MB
Timestamp: 2022-04-10 11:54:04.010978975 +0000 UTC
Metadata: architecture=”amd64″
docker={
“Architecture”: “amd64”,
“Author”: “”,
“Comment”: “buildkit.dockerfile.v0”,
“Created”: “2022-03-29T12:06:20.080676737Z”,

Tamper Resistance of the Build Service
Notarizing through the VCN command-line tool does not only generate metadata about the software artifact. It will also store the metadata attached to the unique hash-value of the asset in immudb. immudb is a tamper-evident open source database developed by Codenotary. immudb ensures that the metadata can’t be changed by any person or process after the fact.

Extra Resistance to Specific Threats
Codenotary Cloud is fully auditable and VCN uses authentication to provide support for the different roles and responsibilities in the DevOps process. Developers can notarize their commits while auditors can authenticate assets and also set them into an “untrusted” state. The login is done via API-Key set as an environment variable:

export VCN_LC_API_KEY=<apikey>
vcn login –lc-host <host-dns-name>

With VCN Auditors are even capable of notarizing and authenticating running containers and its dependencies:

vcn notarize --bom container://springrce

It is possible to search for the affected software by it’s version and set its Status to UNTRUSTED:

vcn authenticate --bom-what-includes --name spring-webmvc --version "<5.3.18"
UID: 1649443904655025803
Kind: java
Name: spring-webmvc
Hash: d62bd1ef6a9aee74557bd59fb96030fd52cf2fc1
Timestamp: 2022-04-08 18:51:44.655025803 +0000 UTC
Metadata: hashtype=”SHA1″
version=”5.3.17″
SignerID: sebastian
Apikey revoked: no
Status: TRUSTED
Included in: container-runtime_springrce 5547604d87c330777990fb15cced288ed6dad0da380a0cdab9800a618d729a5d
vulfocus/spring-core-rce-2022-03-29:latest 82b20510737b27eae390a7ecfa517e9d2eb2e8a5084e02d55bdd402bf28d4ecc
vulfocus/spring-core-rce-2022-03-29:latest 82b20510737b27eae390a7ecfa517e9d2eb2e8a5084e02d55bdd402bf28d4ecc

Take a look at the Codenotary web interface to visualize the work of the command-line tool here.

Highest Levels of Confidence and Trust
Two-person review is an already established best practice before the release of new software. With Codenotary Cloud, this best practice can be implemented more granularly. Reproducible builds, though not strictly required, provide true audibility and reliability benefits. You can see a real life example of this too, just check out our blog about building immudb in a consistent and reproducible way with openSUSE’s Open Build Service.

Conclusion

In this blog we have shown how to handle vulnerabilities by working with guidelines from the SLSA Framework and using Codenotary Cloud. It is straightforward and surprisingly simple once the concept is understood. Vulnerabilities are a constant threat and there are more to come in the future. Log4j and Spring4Shell are huge warning signs. Implementing the SLSA Framework will increase resilience against attacks and vulnerabilities. The tools for that are already on the market. So stop worrying and start implementing.

CNIL Metrics & Logs

Self-Hosted performance monitoring and compliant log analysis for VMware vSphere, container and much more.

immudb

Built on the fastest immutable ledger technology. Open Source and easy to use and integrate into existing application.

Codenotary Cloud

Trusted CI/CD, SBOM and artifact
protection with cryptographic proof.
One CLI to manage all.

MOST POPULAR

Sorry. No data so far.

Subscribe to Our Newsletter

Get the latest product updates, company news, and special offers delivered right to your inbox.

Subscribe to our newsletter

Use Case - Tamper-resistant Clinical Trials

Goal:

Blockchain PoCs were unsuccessful due to complexity and lack of developers.

Still the goal of data immutability as well as client verification is a crucial. Furthermore, the system needs to be easy to use and operate (allowing backup, maintenance windows aso.).

Implementation:

immudb is running in different datacenters across the globe. All clinical trial information is stored in immudb either as transactions or the pdf documents as a whole.

Having that single source of truth with versioned, timestamped, and cryptographically verifiable records, enables a whole new way of transparency and trust.

Use Case - Finance

Goal:

Store the source data, the decision and the rule base for financial support from governments timestamped, verifiable.

A very important functionality is the ability to compare the historic decision (based on the past rulebase) with the rulebase at a different date. Fully cryptographic verifiable Time Travel queries are required to be able to achieve that comparison.

Implementation:

While the source data, rulebase and the documented decision are stored in verifiable Blobs in immudb, the transaction is stored using the relational layer of immudb.

That allows the use of immudb’s time travel capabilities to retrieve verified historic data and recalculate with the most recent rulebase.

Use Case - eCommerce and NFT marketplace

Goal:

No matter if it’s an eCommerce platform or NFT marketplace, the goals are similar:

  • High amount of transactions (potentially millions a second)
  • Ability to read and write multiple records within one transaction
  • prevent overwrite or updates on transactions
  • comply with regulations (PCI, GDPR, …)


Implementation:

immudb is typically scaled out using Hyperscaler (i. e. AWS, Google Cloud, Microsoft Azure) distributed across the Globe. Auditors are also distributed to track the verification proof over time. Additionally, the shop or marketplace applications store immudb cryptographic state information. That high level of integrity and tamper-evidence while maintaining a very high transaction speed is key for companies to chose immudb.

Use Case - IoT Sensor Data

Goal:

IoT sensor data received by devices collecting environment data needs to be stored locally in a cryptographically verifiable manner until the data is transferred to a central datacenter. The data integrity needs to be verifiable at any given point in time and while in transit.

Implementation:

immudb runs embedded on the IoT device itself and is consistently audited by external probes. The data transfer to audit is minimal and works even with minimum bandwidth and unreliable connections.

Whenever the IoT devices are connected to a high bandwidth, the data transfer happens to a data center (large immudb deployment) and the source and destination date integrity is fully verified.

Use Case - DevOps Evidence

Goal:

CI/CD and application build logs need to be stored auditable and tamper-evident.
A very high Performance is required as the system should not slow down any build process.
Scalability is key as billions of artifacts are expected within the next years.
Next to a possibility of integrity validation, data needs to be retrievable by pipeline job id or digital asset checksum.

Implementation:

As part of the CI/CD audit functionality, data is stored within immudb using the Key/Value functionality. Key is either the CI/CD job id (i. e. Jenkins or GitLab) or the checksum of the resulting build or container image.

White Paper — Registration

We will also send you the research paper
via email.

CodeNotary — Webinar

White Paper — Registration

Please let us know where we can send the whitepaper on CodeNotary Trusted Software Supply Chain. 

Become a partner

Start Your Trial

Please enter contact information to receive an email with the virtual appliance download instructions.

Start Free Trial

Please enter contact information to receive an email with the free trial details.