Description

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.0",
  "pubDate": "2026-08-27T20:17:55.227Z",
  "pubdate": "2026-08-27T20:17:55.227Z",
  "executiveSummary": "This vulnerability involves potential Arbitrary File Read and Server-Side Request Forgery (SSRF) within multiple versions of Spring Cloud Function.\nThe flaw resides in the handling of input processing within the framework, allowing an attacker to manipulate internal resource requests or traverse the file system.\nAffected products include Spring Cloud Function 5.0.0 - 5.0.3, 4.3.0 - 4.3.4, and 4.2.0 - 4.2.7.\nThe risk is critical as it enables unauthorized access to sensitive local system files and facilitates the pivoting of network requests to internal services that are otherwise protected by firewalls.\nExploitation does not inherently require high-level administrative privileges but relies on the accessibility of the vulnerable function endpoint to the attacker.\nSuccessful exploitation allows attackers to bypass security boundaries, potentially leading to information disclosure, credential theft, or further lateral movement within the infrastructure.",
  "technicalDetails": "The vulnerability originates from improper validation of input parameters processed by the Spring Cloud Function library, specifically during the handling of routing or function invocation requests. In the context of SSRF, the framework's internal components fail to adequately sanitize user-supplied URLs or URI patterns, allowing an attacker to coerce the application into making HTTP/S or other protocol-based requests to arbitrary internal or external endpoints. This allows an attacker to interact with internal metadata services, management interfaces, or internal APIs that are typically restricted from external network access.\nRegarding the Arbitrary File Read component, the vulnerability stems from inadequate sanitization of file paths or resource identifiers when the framework processes incoming requests. By injecting path traversal sequences (such as ../ or absolute path references) into vulnerable fields, an attacker can escape the intended root directory to read configuration files, application source code, or sensitive system files (e.g., /etc/passwd or application.properties) stored on the host server.\nThe attack flow typically initiates with the attacker identifying a vulnerable entry point within the Spring Cloud Function pipeline, such as a header or a body parameter utilized by the function routing mechanism. By crafting a malicious payload, the attacker sends an HTTP request containing the targeted file path or the SSRF target URI. The framework, failing to implement strict allow-listing or path normalization, passes these inputs to the underlying system calls. For SSRF, the library's network client performs the request on behalf of the attacker, returning the resulting output directly to the user or an out-of-band logging system. For file reads, the application interprets the traversed path and returns the file content as part of the response or logs, facilitating immediate data exfiltration.\nThese vulnerabilities exist within the core request handling components of the specified Spring Cloud Function versions. The exploitability is primarily network-dependent, requiring the attacker to reach the vulnerable function via the network. No specific authentication is required if the endpoint is exposed, and the attacker does not need high-level privileges to trigger the flaw if the underlying server process has file system or network access rights. Post-exploitation, an attacker can leverage the SSRF capability to conduct internal port scanning or perform operations against local services, while the file read capability provides an avenue for reconnaissance and the extraction of environment-specific secrets, significantly elevating the potential for full system compromise."
}