Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

Summary

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: • You use Spring Security • EndpointRequest.to() has been used in a Spring Security chain configuration • The endpoint which EndpointRequest references is disabled or not exposed via web • Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: • You don't use Spring Security • You don't use EndpointRequest.to() • The endpoint which EndpointRequest.to() refers to is enabled and is exposed • Your application does not handle requests to /null or this path does not need protection

Timeline

1. Apr 28, 2025, 7:10 AM UTCCVE published
2. Apr 28, 2025, 4:16 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. May 16, 2025, 11:03 PM UTCRecord last updated

Affected versions

• Spring Spring Boot

  From 2.7.x · fixed in 2.7.25; From 3.1.x · fixed in 3.1.16; From 3.2.x · fixed in 3.2.14; From 3.3.x · fixed in 3.3.11; From 3.4.x · fixed in 3.4.5

• org.springframework.boot:spring-bootMaven

  through 2.7.24.2

• org.springframework.boot:spring-bootMaven

  From 3.1.0 · through 3.1.15.2

• org.springframework.boot:spring-bootMaven

  From 3.2.0 · through 3.2.13.2

• org.springframework.boot:spring-bootMaven

  From 3.3.0 · fixed in 3.3.11

• org.springframework.boot:spring-bootMaven

  From 3.4.0 · fixed in 3.4.5

References 2