CVE-2025-22235 in Spring Boot
Summary
by MITRE • 04/28/2025
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
* You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
* You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/28/2025
This vulnerability exists within Spring Security's endpoint request matching mechanism where the EndpointRequest.to() method fails to properly validate endpoint states when creating matchers. When an actuator endpoint is disabled or not exposed via web, the method incorrectly generates a matcher for the null/** pattern, creating an unintended security exposure. The flaw stems from inadequate state validation during matcher creation, allowing for improper path matching when endpoint configuration does not align with expected operational parameters. This represents a classic case of improper input validation and state management in security configuration components. The vulnerability falls under CWE-20: Improper Input Validation and aligns with ATT&CK technique T1078.004: Valid Accounts: Cloud Accounts, as it could enable unauthorized access through misconfigured endpoint protection. The issue manifests specifically within Spring Security's web security configuration where EndpointRequest.to() is utilized in security chain definitions.
The technical implementation flaw occurs when Spring Security's EndpointRequest.to() method processes disabled or non-exposed endpoints without proper validation of their operational state. The method creates a matcher for null/** pattern when it should either skip the matching process or throw an appropriate exception indicating the endpoint is not available for security configuration. This creates a security boundary that inadvertently allows access to paths that should be restricted, particularly when the application handles requests to /null paths. The matcher generation process fails to account for the disabled state of the referenced endpoint, leading to a scenario where security rules may be applied incorrectly or not applied at all. This behavior creates a potential attack surface where malicious actors could exploit the misconfigured security rules to access restricted resources or bypass intended access controls.
The operational impact of this vulnerability is significant for applications that rely on Spring Security's endpoint protection mechanisms. When an application uses EndpointRequest.to() in security configurations and has disabled endpoints that should not be accessible, the system may inadvertently expose the null/** path pattern to unauthorized access. This could allow attackers to probe or access resources that should be protected, particularly when the application handles requests to /null paths that require protection. The vulnerability essentially creates a false security boundary where the system believes it has properly configured access controls, but in reality, it has created an unintended access path. This affects applications following standard Spring Boot actuator security patterns where endpoint exposure configuration is separated from security configuration, leading to potential information disclosure or privilege escalation scenarios.
Organizations should implement immediate mitigations including validating endpoint states before applying security configurations through EndpointRequest.to() method calls. The recommended approach involves ensuring that any endpoint referenced by EndpointRequest.to() is both enabled and exposed before incorporating it into security chains. Security configurations should include explicit checks for endpoint availability and state before matcher creation. Additionally, applications should avoid using EndpointRequest.to() with disabled endpoints and instead implement alternative security configuration approaches. This vulnerability highlights the importance of proper state validation in security frameworks and aligns with security best practices outlined in OWASP Top 10 2021 A05: Security Misconfiguration. Organizations should also consider implementing monitoring for unexpected access patterns to /null paths and ensure comprehensive testing of security configurations including disabled endpoint scenarios. The mitigation strategy should include regular security audits of endpoint configurations and proper validation of security rule application to prevent similar state management issues in other security components.