Vulnerability Check Spring4Shell

@Marc Saunders -

I’d recommend opening a support request here to get an official answer from Miro: Submit a request – Miro Support & Help Center

Kiron

@Marc Saunders Is your question directed towards Miro or the community members?

Both really, i have sent a request to Miro for info regarding this, but as no one has asked this question yet, i thought i’d ask in case anyone knew.

@Marc Saunders Looking at job openings at Miro, it seems like they're using Spring for backend services:

Miro is looking for an enthusiastic Tech Talent, who will help to achieve ambitious goals. Miro expects you to have a strong experience in your area, readiness to drive change and experiment in search of the best solution possible, understanding how to work with big loads and be able to scale it, and, most importantly, to bring real value to real users. Currently they are looking for: 

• Senior Backend Engineer 57:
  • 3+ years of backend experience. Java ecosystem is preferable, but other languages aren't blockers
  • Java 11, Spring (+Spring Boot), Hazelcast, Redis, PostgreSQL, TestNG & Mockito
  • Maven, Git, Jira, Confluence, Bamboo, BitBucket
  • AWS (S3, EC2), Docker, Linux

Source: https://miro.pitchme.co/#role

@Marc Saunders 

Did they reply on your request? I also asked about it in a request.

@Marc Saunders @Departement ICT 

Miro is aware of the recent vulnerability releases related to Java Spring Framework and associated software components: CVE-2022-22963, CVE-2022-22965.

We'd like to confirm that Miro is not impacted by these specific vulnerabilities and respective attack scenarios.

What has Miro done to address the issue(s)?

• Miro has implemented and validated block rules in its WAF for these CVEs related to the Spring vulnerabilities;
• Miro has reviewed all potentially impacted components, as of now there are no systems affected by this issue;
• As it's a zero-day vulnerability and the nature of the vulnerability is more general, our security and engineering teams are keeping track of related updates and continue to follow our software update procedures.

Hope this helps!

@Varun Jain Sounds good! 👏