CVE-2025-41243: Spring Cloud Gateway Property Vulnerability

CVE-2025-41243 Overview

Spring Cloud Gateway Server Webflux contains a critical vulnerability that allows for Spring Environment property modification. This vulnerability affects applications using Spring Cloud Gateway Server Webflux when combined with Spring Boot actuator dependencies and exposed, unsecured actuator endpoints. Successful exploitation enables attackers to modify Spring Environment properties remotely, potentially leading to complete system compromise.

An application is considered vulnerable when all the following conditions are true: the application uses Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable), Spring Boot actuator is a dependency, the Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway, the actuator endpoints are available to attackers, and the actuator endpoints are unsecured.

Critical Impact

This Code Injection vulnerability (CWE-94) allows unauthenticated remote attackers to modify Spring Environment properties, potentially leading to remote code execution, data exfiltration, and complete system takeover with a maximum CVSS score indicating critical severity.

Affected Products

• Spring Cloud Gateway Server Webflux (vulnerable versions)
• Applications with Spring Boot actuator dependency and exposed gateway endpoints
• Systems with unsecured actuator web endpoints enabled via management.endpoints.web.exposure.include=gateway

Discovery Timeline

• September 16, 2025 - CVE-2025-41243 published to NVD
• September 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-41243

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and represents a severe security flaw in Spring Cloud Gateway Server Webflux. The vulnerability arises from insufficient access controls on the Gateway actuator endpoints, allowing unauthorized modification of Spring Environment properties. When exploited, attackers can manipulate the runtime configuration of the application, potentially injecting malicious configurations that could lead to remote code execution.

The attack surface is limited to applications meeting specific criteria: they must use Spring Cloud Gateway Server Webflux (not WebMVC), have Spring Boot actuator as a dependency, expose the gateway actuator endpoint, and lack proper authentication on these endpoints. However, when these conditions are met, the vulnerability presents maximum risk with the ability to affect confidentiality, integrity, and availability across trust boundaries.

Root Cause

The root cause of CVE-2025-41243 lies in the design of the Spring Cloud Gateway Server Webflux actuator endpoint, which permits modification of Spring Environment properties without adequate authorization checks. When the gateway actuator endpoint is exposed via management.endpoints.web.exposure.include=gateway without proper security controls, it becomes accessible to any network-based attacker. This enables unauthorized manipulation of environment properties that control application behavior, routing rules, and potentially code execution paths.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Attackers can remotely target the exposed actuator endpoints over HTTP/HTTPS to send malicious requests that modify Spring Environment properties. The exploitation path typically involves:

1. Discovery of exposed actuator endpoints on the target application
2. Identification of the vulnerable /actuator/gateway endpoint
3. Crafting malicious requests to modify environment properties
4. Leveraging modified properties to achieve code injection or other malicious outcomes

The vulnerability mechanism relies on the actuator framework's ability to dynamically modify application properties at runtime. Attackers can exploit this by sending specially crafted HTTP requests to the gateway actuator endpoint. For detailed technical information on the exploitation mechanics and remediation steps, refer to the Spring CVE-2025-41243 Advisory.

Detection Methods for CVE-2025-41243

Indicators of Compromise

• Unexpected HTTP requests to /actuator/gateway or related actuator endpoints from external IP addresses
• Unusual modifications to Spring Environment properties logged in application audit trails
• Anomalous application behavior following actuator endpoint access
• Network traffic patterns indicating reconnaissance or exploitation attempts against actuator endpoints

Detection Strategies

• Monitor web server access logs for requests to /actuator/* endpoints, particularly /actuator/gateway
• Implement network intrusion detection rules to identify actuator endpoint access from unauthorized sources
• Deploy application-level logging to capture all actuator endpoint interactions and property modifications
• Utilize SentinelOne Singularity Platform to detect suspicious process behavior and code injection attempts

Monitoring Recommendations

• Enable comprehensive logging for all Spring Boot actuator endpoint access
• Configure alerting for any external access attempts to actuator management endpoints
• Monitor for runtime configuration changes in Spring Environment properties
• Implement baseline behavioral analysis to detect anomalous application execution patterns

How to Mitigate CVE-2025-41243

Immediate Actions Required

• Audit all Spring Cloud Gateway Server Webflux applications for exposed actuator endpoints
• Disable the gateway actuator endpoint if not required: remove gateway from management.endpoints.web.exposure.include
• Implement strong authentication and authorization on all actuator endpoints
• Restrict network access to actuator endpoints using firewall rules or network segmentation
• Apply vendor patches as soon as they become available from Spring

Patch Information

Spring has released a security advisory for CVE-2025-41243. Organizations should consult the Spring CVE-2025-41243 Advisory for official patch information and updated versions. Apply the latest security patches to Spring Cloud Gateway Server Webflux as soon as they are available from the vendor.

Workarounds

• Remove gateway from management.endpoints.web.exposure.include configuration to disable the vulnerable endpoint
• Implement Spring Security to require authentication for all actuator endpoints
• Use network-level controls to restrict actuator endpoint access to trusted internal networks only
• Configure management server to run on a separate port with restricted access

# Configuration example - Secure actuator endpoints
# application.properties or application.yml

# Option 1: Disable gateway actuator endpoint entirely
management.endpoints.web.exposure.include=health,info

# Option 2: Require authentication for actuator endpoints
management.endpoints.web.exposure.include=gateway
spring.security.user.name=admin
spring.security.user.password=${SECURE_PASSWORD}
management.endpoint.gateway.enabled=true

# Option 3: Bind management endpoints to localhost only
management.server.address=127.0.0.1
management.server.port=8081