Description

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-27T20:17:54.573Z",
  "pubdate": "2026-08-27T20:17:54.573Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within Spring Cloud Commons, specifically concerning the writable /actuator/env endpoint.\nThe absence of an allow list for property keys allows unauthorized actors to manipulate the internal configuration state of a Spring application.\nBy modifying application properties at runtime, an attacker can potentially achieve Remote Code Execution (RCE) or sensitive data exfiltration depending on the application context and environment variables.\nThe vulnerability affects multiple branches of Spring Cloud Commons, including versions 5.0.0-5.0.2, 4.3.0-4.3.3, 4.0.0-4.2.6, and 3.1.10 and earlier.\nSuccessful exploitation requires network access to the /actuator/env endpoint, and the potential impact is critical, as it bypasses standard configuration security controls.\nRisk is amplified in environments where administrative endpoints are exposed without proper authentication or network-level access control.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of the writable /actuator/env endpoint within Spring Cloud Commons. In Spring Boot Actuator, the /env endpoint is designed to expose configuration properties; however, when configured as writable, it allows POST requests to update the application's Environment object.\nThe flaw manifests because there is no server-side allow list or validation logic implemented to restrict which property keys can be updated by an authenticated or unauthenticated user depending on global security settings. This lack of constraint allows an attacker to inject arbitrary key-value pairs into the Spring Environment.\nThe exploitation flow typically begins with an attacker identifying an accessible /actuator/env endpoint that supports POST operations. The attacker sends a POST request with a crafted JSON payload containing the key-value pair of interest. By targeting specific configuration properties—such as those used by Spring's SpEL (Spring Expression Language) evaluation or logging configurations—the attacker can alter the application's runtime behavior.\nA common attack vector involves modifying properties that influence the loading of logging configurations or the binding of environment variables to internal beans. If an attacker can inject properties that point to malicious external resources, or trigger the evaluation of malicious SpEL expressions during property resolution, they can achieve arbitrary code execution within the context of the JVM running the Spring application.\nBecause the Environment object is global to the application context, the injection impacts the entire lifecycle of the application until a restart occurs. This provides the attacker with a persistent configuration modification within the session, enabling post-exploitation activities such as exfiltrating credentials stored in system properties or redirecting data flows to external infrastructure.\nAffected versions include Spring Cloud Commons 5.0.0 - 5.0.2, 4.3.0 - 4.3.3, 4.0.0 - 4.2.6, and 3.1.10 and earlier. The vulnerability is highly sensitive to the application's existing configuration, as the specific impact depends on the beans and configurations active at runtime."
}