Spring Cloud Gateway Server Webflux Environment Variable Exposure Vulnerability

A vulnerability exists in certain versions of Spring Cloud Gateway Server Webflux, allowing the exposure of environment variables and system properties to attackers. This issue arises when an admin or untrusted third party uses Spring Expression Language (SpEL) to access these variables through routes. The vulnerability is present if the Spring Cloud Gateway Server Webflux actuator web endpoint is enabled and unsecured, and the actuator endpoints are accessible to attackers.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive environment variables and system properties, potentially allowing attackers to manipulate application behavior or access restricted information.