Bug 2362668 (CVE-2025-22235)

Summary:	CVE-2025-22235 org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adupliak, aschwart, asoldano, ataylor, bbaranow, bmaxwell, boliveir, brian.stansberry, cdewolf, chfoley, cmiranda, darran.lofthouse, dbruscin, dhanak, dkreling, dosoudil, drichtar, drosa, ecerquei, fjuma, fmariani, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jkoops, jpoth, jrokos, jross, jscholz, kaycoth, kvanderr, kverlaen, lgao, mnovotny, mosmerov, mposolda, msochure, msvehla, nwallace, pbizzarr, pcongius, pdelbell, pdrozd, peholase, pesilva, pjindal, pmackay, porcelli, pskopek, rguimara, rkieley, rmartinc, rowaters, rstancel, rstepani, sausingh, smaestri, ssilvert, sthorger, swoodman, tcunning, tom.jenkinson, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Spring Boot configuration. This vulnerability allows unauthorised access to the /null/** path via misconfigured security matchers when referencing disabled or non-exposed Spring Boot actuator endpoints.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2368852
Bug Blocks:

Description OSIDB Bzimport 2025-04-28 08:01:15 UTC

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.

Your application may be affected by this if all the following conditions are met:

  *  You use Spring Security
  *  EndpointRequest.to() has been used in a Spring Security chain configuration
  *  The endpoint which EndpointRequest references is disabled or not exposed via web
  *  Your application handles requests to /null and this path needs protection


You are not affected if any of the following is true:

  *  You don't use Spring Security
  *  You don't use EndpointRequest.to()
  *  The endpoint which EndpointRequest.to() refers to is enabled and is exposed
  *  Your application does not handle requests to /null or this path does not need protection