Description

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-27T06:17:17.813Z",
  "pubdate": "2026-08-27T06:17:17.813Z",
  "executiveSummary": "The JsonToGrpcGatewayFilterFactory in Spring Cloud Gateway is vulnerable to an arbitrary resource access flaw, which allows unauthorized parties to read sensitive files within the application's environment.\nThe vulnerability involves the improper handling of proto descriptor definitions, enabling an attacker to specify arbitrary Spring Resource locations.\nBy manipulating input parameters, a remote attacker can force the application to read files that were not intended to be exposed via the filter configuration.\nThis vulnerability affects multiple versions of Spring Cloud Gateway, including the 5.x, 4.x, and 3.x release branches.\nThe risk implication is significant, as it may lead to the disclosure of sensitive configuration data, environment variables, or local system files, potentially facilitating further exploitation or system compromise.\nExploitation does not necessarily require high-level privileges, depending on the network exposure of the gateway filter, and relies on the ability to influence the configuration of the JsonToGrpcGatewayFilterFactory.",
  "technicalDetails": "The vulnerability resides within the JsonToGrpcGatewayFilterFactory component, which is responsible for converting JSON requests to gRPC calls. This factory utilizes a proto descriptor to define the structure of the messages involved in the conversion process.\nThe root cause is an insufficient validation mechanism during the parsing and retrieval of the proto descriptor file. The application accepts a location path for the descriptor, which is processed using Spring's Resource abstraction without adequately sanitizing or restricting the input against unauthorized paths.\nWhen an attacker specifies a malicious resource location, the Spring Resource loader resolves the path and attempts to access the file from the underlying filesystem or classpath. Because the filter factory does not enforce a whitelist of permitted directories or restricted protocols, it can be coerced into accessing any file accessible to the application process.\nThe attack flow proceeds as follows: First, an attacker identifies an endpoint or configuration interface that leverages the JsonToGrpcGatewayFilterFactory. Second, the attacker provides a crafted input containing an arbitrary file path (e.g., using 'file://' URI schemes or path traversal sequences) to the proto descriptor definition parameter. Third, the JsonToGrpcGatewayFilterFactory processes this input and uses the Spring Resource loader to fetch the content of the target file. Finally, the contents of the retrieved file are processed by the filter, and depending on the implementation details and error handling, the contents may be returned to the attacker in the response body or reflected through system logs.\nThis flaw is present in several major release lines, specifically Spring Cloud Gateway 5.0.0 - 5.0.2, 4.3.0 - 4.3.5, 4.0.0 - 4.2.9, and 3.1.13 and earlier. Successful exploitation is highly dependent on the application's ability to expose the results of the descriptor loading process.\nThe impact of this vulnerability is a critical information disclosure. Once an attacker successfully triggers the resource load, they can bypass intended file access controls, potentially accessing sensitive configuration files like 'application.yml', property files containing credentials, or internal secrets, which significantly broadens the potential for a full system compromise."
}