10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41243

CVE-2025-41243: Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.

An application should be considered vulnerable when all the following are true:

The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
Spring Boot actuator is a dependency.
The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
The actuator endpoints are available to attackers.
The actuator endpoints are unsecured.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41243

CVE-2025-41243:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.cloud:spring-cloud-gateway-server-webflux	maven	>= 3.1.0, <= 3.1.10
org.springframework.cloud:spring-cloud-gateway-server-webflux	maven	>= 4.0.0, <= 4.1.10
org.springframework.cloud:spring-cloud-gateway-server-webflux	maven	>= 4.2.0, < 4.2.5	4.2.5
org.springframework.cloud:spring-cloud-gateway-server-webflux	maven	>= 4.3.0, < 4.3.1	4.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Spring Expression Language (SpEL) injection vulnerability in the Spring Cloud Gateway actuator endpoint, which allows for property modification and potential remote code execution. The analysis of the commits between the last vulnerable version (4.3.0) and the first patched version (4.3.1) identified a security fix in commit b957599edcb26107d0e16d2675f7139a2be4d996. This commit modifies the ShortcutConfigurable.java file to disable property assignment in the SpEL EvaluationContext. The change is specifically within the constructor of the GatewayEvaluationContext inner class. This context is used when processing requests to the actuator. By not having assignment disabled, an attacker could provide a crafted SpEL expression that modifies application properties. The vulnerable function is the constructor org.springframework.cloud.gateway.support.ShortcutConfigurable$GatewayEvaluationContext.GatewayEvaluationContext, as it was responsible for creating the overly permissive evaluation context that enabled the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.