Spring Cloud Gateway Server WebFlux Property Modification Vulnerability

A vulnerability allowing unauthorized modification of Spring Environment properties may exist in certain versions of Spring Cloud Gateway Server WebFlux. This issue arises when the application includes the Spring Boot actuator, with the Spring Cloud Gateway Server WebFlux actuator web endpoint enabled and exposed to attackers without security. Affected versions include Spring Cloud Gateway 4.3.0 through 4.3.x, 4.2.0 through 4.2.x, 4.1.0 through 4.1.x, 4.0.0 through 4.0.x, 3.1.0 through 3.1.x, and older unsupported versions.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of application properties, potentially allowing attackers to alter application behavior or configuration.

Remediation

Users should upgrade to Spring Cloud Gateway versions 4.3.1, 4.2.5, 4.1.11, or 3.1.11, depending on their current version. If an upgrade is not possible, remove 'gateway' from the 'management.endpoints.web.exposure.include' property or secure the actuator endpoints.