A zero-day exploit affecting the Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions was made public on March 30, 2022, allowing an unauthenticated attacker to execute arbitrary code on the target system.
Citrix recommends that customers hosting affected web applications follow Spring’s recommendations. In addition, Citrix Web App Firewall (WAF) customers should consider the following recommendations to improve the security of their applications from this vulnerability.
The Citrix research team has released updated Citrix WAF signatures designed to mitigate in part the CVE-2022-22963, CVE-2022-22965 vulnerability. If you are using any of these Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions), Citrix strongly recommends that you download the signatures version 79 and apply to your Citrix WAF deployments as an additional layer of protection for your applications. Signatures are compatible with the following software versions of Citrix Application Delivery Controller (ADC) 11.1, 12.0, 12.1, 13.0 and 13.1. Please note, versions 11.1 and 12.0 are end of life. Learn more about the release life cycle.
| Signature rule | CVE ID | Description |
| 18959 | CVE-2022-22965 | WEB-MISC VMware Spring4Shell, SpringSource Spring Framework class.classloader RCE attempt |
| 999005 | CVE-2022-22963 | WEB-MISC Spring Cloud Function – Code Injection Vulnerability (CVE-2022-22963) |
If you are already using Citrix WAF with signatures with auto-update feature enabled, you may follow these steps after verifying that the signature version is at least version 79.
- Search your signatures for Spring LogString
- Select the results with ID 999005, 999004 and 18959
- Choose “Enable Rules” and click OK
Citrix ADC Standard and Advanced edition customers, as well as Premium edition customers who do not have WAF signatures enabled, can use responder policies for protection as shown below. Please bind the responder policy to the appropriate bind point (vserver or global).
add responder policy mitigate_cve_2022_22963_22965 q^(HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.
CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ DROPCitrix recommends that Citrix WAF customers use the latest signature version, enable signatures auto-update, and subscribe to receive signature alert notifications. Citrix will continue to monitor this dynamic situation and update as new mitigations become available.
If any of your application availability is inadvertently impacted due to false positives resulting from above mentioned mitigation policies, Citrix recommends the following modifications to the policy. Please note that any end point covered by the exception_list may expose those assets to the risks from CVE-2022-22963, CVE-2022-22965.
1) Modifications to Responder Policy
add policy patset exception_list
# (Example: bind policy patset exception_list "/exception_url")
set responder policy mitigate_cve_2022_22963_22965 -rule q^HTTP.REQ.URL.CONTAINS_ANY("exception_list").NOT && (HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ 2) Modifications to WAF Policy
add policy patset exception_list
# (Example: bind policy patset exception_list "/exception_url")
Prepend the existing WAF policy with HTTP.REQ.URL.CONTAINS_ANY("exception_list").NOT
# (Example : set appfw policy my_WAF_policy q^HTTP.REQ.URL.CONTAINS_ANY("exception_list").NOT && <existing rule>^Update 1 (April 4th, 2022)
Citrix issued WAF signatures version 80 including updated signatures with rule 999004 for CVE-2022-22965 Spring4Shell security vulnerability.
No changes in responder policies for CVE-2021-22963/CVE-2021-2296 to mitigate Spring4Shell security vulnerability.
Citrix will continue to update this advisory for CVE-2022-22963 and CVE-2022-22965 as additional information becomes available.
Additional Information
Citrix WAF has a single code base across physical, virtual, bare-metal, and containers. This signature update applies to all form factors and deployment models of Citrix WAF.
Learn more about Citrix Web Application Firewall, check out our alert articles and bot signature articles to learn more about Citrix Web App Firewall signature, and find out how you can receive signature alert notifications.
Patches and Mitigations
Citrix strongly recommends that customers apply patches (from Spring and/or other vendors) as soon as they are made available. Until a patch is made available, you may reduce the risk of a successful attack by applying mitigations. Mitigations should not be considered full solutions as they do not fully address the underlying issue(s).
