Spring4Shell, Citrix CVEs, iManage Certificate Expirations

Spring4Shell critical security alert – targeting Java Script Framework
Some products being affected:

• Citrix
• Cisco
• VMware

ADVISORY: Update required to address https://my.imanlocal.com certificate expiration on June 4, 2022 for versions 10.1.x to 10.6.x.xxx of Work Desktop for Windows by Tyler Walgren

Target audience:

• Cloud customers running iManage Work Desktop for Windows 10.6 and earlier
• On Premises customers running iManage Work Desktop for Windows 10.6 and earlier

On this page:

• Issue
• Background
• Action
• Follow for updates

Issue

On June 4, 2022, a certificate used by the Work Desktop for Windows application (certificate https://my.imanlocal.com) is set to expire for versions 10.1.x to 10.6.x.xxx.

Please review the table below of Work Desktop for Windows versions to verify the following information:

• Affected and unaffected versions of Work Desktop for Windows
• Date of certificate expiration

If your version of Work Desktop for Windows is affected and requires an update, please refer to the Action section below. Versions with a date of certificate expiration of June 4, 2022, 23:59:59 GMT require immediate attention.

Background

https://my.imanlocal.com is an iManage-registered url that is used for the internal loop-back communication between the iManage Work web application and iManage Work Agent. This url was previously used to work around a browser limitation that prevented the use of http://127.0.0.1 to direct internal loopback traffic back to the user machine. All modern web browsers (Chrome, Firefox, Edge Chromium) support using http://127.0.0.1, which eliminates the need for the https://my.imanlocal.com address.

NOTE: Internal desktop communication is used by iManage Work Web to communicate with iManage Work Desktop for Windows and as such, the http://127.0.0.1 call will never leave the user’s desktop machine.

Starting with Work Desktop for Windows 10.7.x, the client will default to using http://127.0.0.1 for Agent communications. All previous versions of Work Desktop for Windows use https://my.imanlocal.com by default.

If Work Desktop for Windows 10.6.x or older is being used with the default setting to use https://my.imanlocal.com when this certificate expires on your machine, the following iManage Work and iManage Work Desktop for Windows functions will no longer function as expected.

Document Actions:

• Edit
• Open in Protected View
• Take Offline
• Print
• Share > Send Link, Send Document, or Send Both
• More Actions > Checkout

Multiselect Actions:

• Download
• Take Offline
• Print
• Compare
• Share > Send Link, Send Document, or Send Both
• More Actions > Checkout

Email actions:

• Reply
• Reply All
• Forward
• Open
• Print

Action

For environments with Work Web versions 10.2.6.61 and later and Work Desktop for Windows versions 10.7.x and later:

No action needed, these versions will use http://127.0.0.1 by default.

For environments with Work Web versions 10.2.6.61 and later and Work Desktop for Windows versions 10.2.4.71 up to 10.7.x:

1. Close all iManage Integrated applications.

2. Set the following registry configuration:

For x86 clients
Location:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\imanage\work\10.0\client\agent

For x64 clients
Location: HKEY_LOCAL_MACHINE\SOFTWARE\imanage\work\10.0\client\agent
Name: SecuredLocalHost
Type: DWORD
Values: 0
1 – (default) use https://my.imanlocal.com
0 – use http://127.0.0.1

3. Restart the iManage Agent Web Service from Task Manager > Services or from services.msc.

4. Restart the iManage Agent from the System Tray.

5. Refresh the Work Web Client in the browser.

For environments with Work Web versions 10.2.6.61 and later and Work Desktop for Windows versions prior to 10.2.4.71:

An upgrade to Work Desktop for Windows 10.2.4.71 or higher is required as the SecuredLocalHost setting was introduced starting with version 10.2.4.71.

If you are unable to upgrade to a required minimum version of Work Web or Work Desktop for Windows, please reach out to iManage Support for alternative options.

For environments with Work Web versions prior to 10.2.6.61 and/or Work Desktop for Windows versions prior to 10.2.4.71:

An upgrade to Work Web 10.2.6.61 or higher is required for the Work Web Client to be able to leverage http://127.0.01.
An upgrade to Work Desktop for Windows 10.2.4.71 or higher is required, as the SecuredLocalHost setting was introduced starting with version 10.2.4.71.

Follow for updates

If you have not already subscribed to receive iManage Support notifications, complete these two quick steps to stay informed regarding iManage Support news, advisories, upcoming events, and training:

1. Open the iManage Support Announcements section of Help Center.
2. Select Follow > New articles and comments.

In addition, follow this article for updates by clicking the Follow button at the top of the article.