CVE-2025-41253: Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

The analysis began by reviewing the vulnerability description, which indicated a Spring Expression Language (SpEL) injection vulnerability in Spring Cloud Gateway, allowing access to environment variables. The advisory mentioned that versions up to 4.3.0 were affected. External research confirmed that version 4.3.2 included the patch. By comparing the git tags for versions v4.3.1 and v4.3.2 in the spring-cloud/spring-cloud-gateway repository, the commit e083547c12d2fc45d701b6771efae7d7af019119 was identified as the security fix, titled "Adding custom BeanFactoryResolver".

An in-depth analysis of this commit pinpointed the vulnerability's root cause. The patch modifies org.springframework.cloud.gateway.support.ShortcutConfigurable.java. The normalize method within this class processes configuration for gateway components, which can involve evaluating SpEL expressions from user-provided route definitions.

The vulnerability existed because the SpEL evaluation context used a default BeanFactoryResolver, which did not restrict access to potentially sensitive beans like @systemProperties and @systemEnvironment. An attacker could exploit this by sending a crafted route definition to an exposed gateway actuator endpoint.

The patch addresses this by introducing a new inner class, GatewayBeanFactoryResolver, which overrides the resolve method to explicitly throw an AccessException if an attempt is made to resolve the systemEnvironment or systemProperties beans. The GatewayEvaluationContext, used by the normalize method, was updated to use this new restrictive resolver.

Therefore, org.springframework.cloud.gateway.support.ShortcutConfigurable.normalize is the identified vulnerable function. It is the method that orchestrates the evaluation of the malicious SpEL expression within a permissive context. During an exploit, this function would be present in the runtime profile or stack trace as it processes the malicious payload.