CVE-2025-41243: Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

The vulnerability is a Spring Expression Language (SpEL) injection vulnerability in the Spring Cloud Gateway actuator endpoint, which allows for property modification and potential remote code execution. The analysis of the commits between the last vulnerable version (4.3.0) and the first patched version (4.3.1) identified a security fix in commit b957599edcb26107d0e16d2675f7139a2be4d996. This commit modifies the ShortcutConfigurable.java file to disable property assignment in the SpEL EvaluationContext. The change is specifically within the constructor of the GatewayEvaluationContext inner class. This context is used when processing requests to the actuator. By not having assignment disabled, an attacker could provide a crafted SpEL expression that modifies application properties. The vulnerable function is the constructor org.springframework.cloud.gateway.support.ShortcutConfigurable$GatewayEvaluationContext.GatewayEvaluationContext, as it was responsible for creating the overly permissive evaluation context that enabled the vulnerability.