Cloudanix VulnDB

CVE-2025-41253

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 16, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A configuration issue can let outsiders see internal settings and secrets that should stay hidden if certain management features are left open.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Web Framework
Class
Information Disclosure
Remediation
Config Change
Effort
Low
Patch risk
Low

What it actually does

The vulnerability permits unauthorized access to environment variables and system properties through crafted Spring Expression Language expressions when the gateway actuator endpoint is enabled and reachable.

Why it matters to the business

Attackers may obtain sensitive configuration data such as credentials or internal settings, increasing the risk of further compromise; the issue has been public for over a year with stable low exploit probability and no known ransomware use.

How an attack unfolds

An attacker reaches an exposed and unsecured actuator gateway endpoint, then registers a route containing a SpEL expression that evaluates to environment or system property values, causing the server to return those values in responses.

How to fix it

Upgrade affected deployments to the fixed versions ruby19 (SUSE:Studio Onsite 1.3): 1.9.3.p392-0.26.1 and ruby19 (SUSE:Studio Onsite Runner 1.3): 1.9.3.p392-0.26.1; otherwise disable the gateway actuator endpoint or restrict it behind authentication and network controls.

How to confirm the fix worked

Confirm the actuator endpoint is no longer listed in management.endpoints.web.exposure.include or returns access denied, and verify the installed package version matches or exceeds the stated fixed releases.

Typical attack path

  1. Identify reachable actuator endpoint with gateway exposure enabled
  2. Authenticate or bypass any weak controls on the endpoint
  3. POST a new route definition containing a SpEL expression referencing env or system properties
  4. Trigger the route to receive the leaked values in the response

How to detect it

Review web server and actuator access logs for unexpected POST requests creating routes, and inspect application logs for SpEL expressions that reference environment or system properties.

  • POST /actuator/gateway/routes
  • management.endpoints.web.exposure.include=gateway
  • SpEL expression containing env.getProperty or systemProperties

What your security team should do

  • Apply the listed fixed package versions immediately on all instances
  • Audit and restrict exposure of the gateway actuator endpoint
  • Monitor for new route creations via actuator logs

The record

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes. * An untrusted third party could create a route that uses SpEL to access environment variables or system properties if: * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.springframework.cloud:spring-cloud-gateway-server 0 No fix
Maven org.springframework.cloud:spring-cloud-gateway-server 4.0.0 No fix
Maven org.springframework.cloud:spring-cloud-gateway-server 4.2.0 4.2.6
Maven org.springframework.cloud:spring-cloud-gateway-server 4.3.0 4.3.2
Maven org.springframework.cloud:spring-cloud-gateway-server-webflux 3.1.0 No fix
maven org.springframework.cloud/spring-cloud-gateway-server-webflux 3.1.0 No fix

Related vulnerabilities