¡¾·ì϶¹«¸æ¡¿Spring Cloud Gateway ±í°×ʽעÈë·ì϶(CVE-2025-41253)

°ä²¼¹¦·ò 2025-11-11

Ò»¡¢¡¢¡¢·ì϶¸ÅÊö


·ì϶Ãû³Æ

Spring Cloud Gateway ±í°×ʽעÈë·ì϶

CVE   ID

CVE-2025-41253

·ì϶ÀàÐÍ

±í°×ʽעÈë

·¢ÏÖ¹¦·ò

2025-11-11

·ì϶ÆÀ·Ö

7.5

·ì϶µÈ¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

²»±ØÒª

PoC/EXP

Òѹ«¿ª

ÔÚÒ°ÀûÓÃ

δ·¢ÏÖ


Spring Cloud GatewayÊÇ»ùÓÚSpring Framework 5¡¢¡¢¡¢Project ReactorºÍSpring Boot 2¼°ÒÔÉÏ°æ±¾¹¹½¨µÄ¸ß»úÄÜÍø¹Ø¿ò¼Ü£¬£¬£¬ÓÃÓÚÌṩͳһµÄAPI·ÓÉ¡¢¡¢¡¢¸ºÔØƽºâ¡¢¡¢¡¢ÏÞÁ÷¡¢¡¢¡¢¼à¿ØºÍ°²È«½ÚÖƵÈÖ°ÄÜ¡£Ëüͨ¹ý·´Ó³Ê½±à³ÌÄ£ÐÍ£¨WebFlux£©ÊµÏÖÒì²½·Ç×èÈû´¦Ö㬣¬£¬ºÏÓÃÓÚ΢·þÎñ¼Ü¹¹Ïµĸ߲¢·¢³¡¾°¡ £¿£¿£¿ª·¢Õß¿Éͨ¹ýÅäÖûò´úÂ뷽ʽ½Ã½Ý½ç˵·Óɹ涨¡¢¡¢¡¢¹ýÂËÆ÷Á´¼°È¨ÏÞÕ½Êõ£¬£¬£¬´Ó¶øʵÏÖÒªÇóת·¢¡¢¡¢¡¢Á÷Á¿ÖÎÀíÓ밲ȫ·À»¤µÈÖ÷ÌâÖ°ÄÜ£¬£¬£¬ÊÇSpring Cloud΢·þÎñÉú̬µÄÖØÒª×é¼þÖ®Ò»¡£


2025Äê11ÔÂ11ÈÕ£¬£¬£¬OG¶«·½Ìü¼¯ÍÅVSRC¼à²âµ½Ò»¸öÓ°ÏìSpring Cloud Gateway Server£¨½öÏÞWebFlux°æ±¾£©µÄ±í°×ʽעÈë·ì϶¡£µ±ÀûÓÃÔÚ·ÓÉÅäÖÃÖÐʹÓÃSpring Expression Language£¨SpEL£©ÇÒ¶³öÁËδ¾­½Ó¼û½ÚÖƵÄActuator gateway¶Ëµãʱ£¬£¬£¬¹¥»÷Õß¿Éͨ¹ý»ú¹Ø¶ñÒâ·Óɱí°×ʽ£¬£¬£¬¶Áȡϵͳ»·¾³±äÁ¿ºÍϵͳÊôÐÔ£¬£¬£¬´Ó¶øÔì³ÉÃô¸ÐÐÅϢй¶¡£¸Ã·ì϶µÄ´¥·¢Ç°ÌáÔ̺¬£º£º£ºÆôÓÃmanagement.endpoints.web.exposure.include=gatewayÓëmanagement.endpoint.gateway.enabled=true£¨»òmanagement.endpoint.gateway.access=unrestricted£©£¬£¬£¬ÇÒÓйØActuator½Ó¿Ú¿É±»Íⲿ½Ó¼û¡£


¶þ¡¢¡¢¡¢Ó°ÏìÁìÓò


4.3.0 <= Spring Cloud Gateway < 4.3.2
4.2.0 <= Spring Cloud Gateway < 4.2.6
4.1.0 <= Spring Cloud Gateway < 4.1.12
4.0.0 <= Spring Cloud Gateway < 4.0.12
3.1.0 <= Spring Cloud Gateway < 3.1.12
½Ï¾É¡¢¡¢¡¢²»ÊÜÖ§³ÖµÄ°æ±¾Ò²»áÊܵ½Ó°Ïì


Èý¡¢¡¢¡¢°²È«´ëÊ©


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑ°ä²¼ÐÞ¸´²¹¶¡£¬£¬£¬ÒÔÐÞ¸´¸Ã·ì϶¡£
Spring Cloud Gateway >= 4.3.2
Spring Cloud Gateway >= 4.2.6
Spring Cloud Gateway >= 4.1.12
Spring Cloud Gateway >= 4.0.12
Spring Cloud Gateway >= 3.1.12


ÏÂÔØÁ´½Ó£º£º£ºhttps://spring.io/projects/spring-cloud-gateway/


3.2 һʱ´ëÊ©


´ÓÅäÖÃÖÐɾ³ý management.endpoints.web.exposure.include ÊôÐÔÖÐµÄ gateway»ò¼Ó¹Ì Actuator ¶Ëµã°²È«¡£


3.3 ͨÓý¨Òé


? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£
? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÖÆ£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬¹Ø±Õ·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢¡¢¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£
? Ê¹ÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£
? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÖƺÍ×îСȨÏÞ×¼Ôò£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£
? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£


3.4 ²Î¿¼Á´½Ó


https://spring.io/security/cve-2025-41253/