Updated: April 1st 2022
On March 29, 2022, a Chinese cybersecurity research firm leaked an attack that could impact most enterprise Java applications, globally. An investigation of the issue showed that the root cause was a vulnerability in the widely used, free, community-developed, open-source programming framework called Spring Core. On March 30 we learned through this from a security blog. The CVE is reserved under https://www.cve.org/CVERecord?id=CVE-2022-22965, but more details are available on https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement and https://tanzu.vmware.com/security/cve-2022-22965 and many other locations.
The Admin Interface (AI) is normally not exposed to 'the outside world'. Since the Admin Interface is within a company's network and on the application level protected by username/password credentials, the impact on the AI is assessed as low, but if the Admin Interface is open to the internet then the risk is high and immediate action is needed.
Since a Spring4Shell update is available (version 5.3.18 and version 5.2.20) Deltares will create updates for the supported versions of the Admin Interface. A new version of the Admin Interface is available on request for the supported software versions.
The THREDDS component contains the Spring4Shell libraries. By default the archive server does not make use of forms to fill in data (which are vulnerable for attacks), however it is possible to configure the archive server to use these forms and then the application is vulnerable. To minimize the risk, please ensure that THREDDS is not open to 'the outside world'.
More information on the latest THREDDS news can be found at https://www.unidata.ucar.edu/blogs/news/entry/upgrade-tds-5-to-latest. We are in the process of updating our software to this latest version.
For downloading the latest snapshot see here.
Initial analysis shows that the vulnerability applies only to spring libraries in combination with JDK9+. This means:
Remark: an updated distribution for Delft-FEWS AdminInterface 2018.02 and later will be made available a.s.a.p.
For more information how to obtain new distributions, please contact fews.support@deltares.nl
Follow the instructions on Update the AdminInterface. (wiki login required).
The THREDDS component of the (Delft-FEWS) Open Archive has been updated to the latest version. The latest THREDDS update has been included in our build packages and are available on request. Please follow the instructions on update Open Archive wiki page (wiki login required).
Delft-FEWS Product Management