CVE-2025-41243
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Spring Cloud Gateway is a library that provides an API gateway solution for microservices architectures. It offers a simple yet flexible way to route requests to microservices while providing cross-cutting concerns like security, monitoring, and resiliency through customizable filters. Built on a reactive foundation using Spring WebFlux, it provides high performance and scalability for handling large volumes of requests, while offering features like rate limiting, circuit breakers, request/response transformation, and load balancing out of the box.
A possible environment modification vulnerability (CVE-2025-41243) has been identified in Spring Cloud Gateway.
An environment modification vulnerability occurs when an attacker is able to manipulate aspects of an application’s runtime environment while the application is running. The implications of an environment modification vulnerability are severe, as it can allow changes to environment variables, system properties, or configuration parameters that influence application behavior.This could lead to information disclosure or privilege escalation.
This issue affects multiple versions of Spring Cloud Gateway's spring-cloud-gateway-server package.
Details
Module Info
- Product: Spring Cloud Gateway
- Affected packages: spring-cloud-gateway-server
- Affected versions: >=3.1.0 <=3.1.9, >=4.0.0 <=4.0.9, >=4.1.0 <=4.1.9, >=4.2.0 <4.2.5, >=4.3.0 <4.3.1
- GitHub repository: https://github.com/spring-cloud/spring-cloud-gateway
- Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-gateway-server
- Package manager: Maven
- Fixed In: NES for Spring Cloud Gateway v3.1.14
Vulnerability Info
The security flaw applies to Spring Cloud Gateway applications when specific deployment and configuration conditions align. This vulnerability enables attackers to modify an application’s runtime environment using a Spring Boot actuators endpoint.
The security flaw manifests if all the following conditions occur:
- The Spring Cloud Gateway application has Spring Boot actuators on the classpath
- The Spring Cloud Gateway Server actuator web endpoint is enabled and exposed
- The actuator endpoints are available to attackers and unsecured
Mitigation
Only recent versions of Spring Cloud Gateway are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Cloud Gateway
- Remove gateway from the management.endpoints.web.exposure.include property
- Secure the application Spring Boot actuator endpoints
Leverage a commercial support partner like HeroDevs for post-EOL security support
Credit
