Spring Cloud Gateway Header Forwarding Vulnerability from Untrusted Proxies

A vulnerability exists in Spring Cloud Gateway Server and Spring Cloud Gateway Server MVC, where the 'X-Forwarded-For' and 'Forwarded' headers are forwarded from untrusted proxies. This behavior could potentially allow for the manipulation of request headers, leading to security issues.

Impact

Exploitation of this vulnerability could result in the improper handling of forwarded headers, allowing untrusted proxies to influence the application's request processing.

Remediation

Users should upgrade to Spring Cloud Gateway Server versions 4.3.0, 4.2.3, or 4.1.8, or to Spring Cloud Gateway Server MVC versions 4.2.3 or 4.1.8. After upgrading, 'X-Forwarded-*' and 'Forwarded' header functionality will be disabled by default. If this functionality is needed, 'spring.cloud.gateway.trusted-proxies' or 'spring.cloud.gateway.mvc.trusted-proxies' can be set to specify trusted proxies. If upgrading is not possible, 'X-Forwarded' and 'Forwarded' header functionality can be disabled.