Modificação de propriedade Spring Expression Language usando Spring Cloud Gateway Server WebFlux

The impact of CVE-2025-41243 is severe. Successful exploitation allows an attacker to execute arbitrary code within the context of the Spring Cloud Gateway application. This could lead to complete system compromise, including data exfiltration, denial of service, and further lateral movement within the network. The vulnerability's reliance on exposed actuator endpoints means that applications with misconfigured security settings are particularly vulnerable. The ability to modify environment properties provides a flexible attack surface, potentially bypassing traditional security controls. This vulnerability shares similarities with other Spring framework vulnerabilities where improper configuration of actuator endpoints has led to exploitation.

Organizations deploying Spring Cloud Gateway in production environments, particularly those with misconfigured security settings or legacy applications that expose actuator endpoints without proper authentication, are at significant risk. Shared hosting environments where users have limited control over application configuration are also vulnerable.

• java / server: Monitor application logs for unusual environment property modifications or requests targeting actuator endpoints. Use tools like jps to identify running Spring Cloud Gateway instances and then use netstat or ss to check for exposed actuator endpoints.

jps -l | grep SpringCloudGateway
ss -tulnp | grep 8080 # or the port your gateway uses

• linux / server: Use journalctl to filter for errors or warnings related to Spring Cloud Gateway and actuator endpoints.

journalctl -u spring-cloud-gateway -f | grep -i actuator

• generic web: Use curl to probe for the existence of actuator endpoints (e.g., /actuator/gateway).

curl http://your-gateway-host/actuator/gateway

1. 2025-09-16Disclosure

   disclosure

1. Reservado2025-04-16
2. Publicada2025-09-16
3. Modificada2026-02-26
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-41243 is to upgrade to Spring Cloud Gateway version 4.3.1 or later. If upgrading is not immediately feasible, consider disabling the actuator endpoints by setting management.endpoints.web.exposure.include=none in your application configuration. Alternatively, restrict access to the actuator endpoints using authentication and authorization mechanisms, such as Spring Security. Implement a Web Application Firewall (WAF) with rules to block requests targeting the actuator endpoints. Monitor application logs for suspicious activity related to actuator endpoint access and environment property modifications. After upgrading, confirm the fix by attempting to access the actuator endpoint with unauthorized credentials and verifying that access is denied.