7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-22235

CVE-2025-22235: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.

Your application may be affected by this if all the following conditions are met:

You use Spring Security
EndpointRequest.to() has been used in a Spring Security chain configuration
The endpoint which EndpointRequest references is disabled or not exposed via web
Your application handles requests to /null and this path needs protection

You are not affected if any of the following is true:

You don't use Spring Security
You don't use EndpointRequest.to()
The endpoint which EndpointRequest.to() refers to is enabled and is exposed
Your application does not handle requests to /null or this path does not need protection

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-22235

CVE-2025-22235:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.boot:spring-boot	maven	<= 2.7.24.2
org.springframework.boot:spring-boot	maven	>= 3.1.0, <= 3.1.15.2
org.springframework.boot:spring-boot	maven	>= 3.2.0, <= 3.2.13.2
org.springframework.boot:spring-boot	maven	>= 3.3.0, <= 3.3.10	3.3.11
org.springframework.boot:spring-boot	maven	>= 3.4.0, <= 3.4.4	3.4.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, occurs when EndpointRequest.to() is used for an actuator endpoint that is disabled or not exposed, leading to a matcher for null/**. The provided commit 55f67c9a522647039fd3294dee5cb83f4888160a patches the EndpointRequest.java files for both servlet and reactive stacks.

The core issue was that PathMappedEndpoints.getPath(endpointId) could return null for unexposed endpoints. This null value was then processed by the streamPaths method within the inner EndpointRequestMatcher class. Before the patch, streamPaths did not filter out these null paths.

These null paths were then used by the createDelegate methods (one in the servlet version, one in the reactive version of EndpointRequestMatcher) to construct matchers.

In the servlet version, the null path was passed to RequestMatcherFactory.antPath, which would then treat the null as the string "null" when creating the pattern, resulting in null/**.
In the reactive version, the null path was passed to getDelegateMatcher, which would then create a PathPatternParserServerWebExchangeMatcher using path + "/**", effectively becoming "null/**".

The patches address this by:

Modifying streamPaths to explicitly filter out null values returned by pathMappedEndpoints.getPath().
Adding Assert.notNull checks in RequestMatcherFactory.antPath (servlet) and getDelegateMatcher (reactive) to prevent null paths from being processed into matchers.
Modifying the createDelegate methods to return an EMPTY_MATCHER if no valid delegate matchers can be formed (e.g., if all specified endpoints are unexposed and their paths become null and are filtered out).

The createDelegate methods in EndpointRequest$EndpointRequestMatcher for both servlet and reactive stacks are identified as the vulnerable functions because they orchestrate the faulty logic of using these potentially null paths to create the incorrect matchers. They are the highest-level methods within the matcher object (returned by EndpointRequest.to()) where the decision to form matchers based on these paths occurs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.