Description

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-27T20:17:55.940Z",
  "pubdate": "2026-08-27T20:17:55.940Z",
  "executiveSummary": "The vulnerability involves an improper implementation of the isSecure() method within the ServerlessHttpServletRequest component of Spring Cloud Function. The defect allows the system to incorrectly report the security status of an incoming request, failing to perform actual verification of the request scheme.\nThis flaw affects Spring Cloud Function versions 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, and 4.2.0 through 4.2.7. The vulnerability type is an Improper Verification of Cryptographic/Security Context, which poses significant risk to applications relying on isSecure() to enforce transport layer security policies.\nAn unauthenticated attacker can exploit this condition to bypass security checks that rely on the HTTP request scheme validation. By manipulating request parameters or environmental context in a serverless environment, an attacker may deceive the application into treating an insecure request as a secure one. This could result in the unintended processing of sensitive data over insecure channels or the circumvention of downstream security middleware that mandates encrypted transit, potentially leading to sensitive information disclosure or man-in-the-middle attacks.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation logic of the isSecure() method inside the ServerlessHttpServletRequest class. In a standard Servlet-based environment, the isSecure() method is expected to return a boolean value based on whether the request was received over a secure protocol, such as HTTPS. However, in the affected versions of Spring Cloud Function, the implementation fails to inspect the actual scheme attribute of the request, effectively providing a faulty security assertion.\nIn serverless deployment models, HTTP requests are often proxied through an API gateway or an intermediate wrapper before reaching the function handler. The ServerlessHttpServletRequest is designed to map these incoming platform-specific events into a familiar Servlet API structure. The vulnerability exists because the code responsible for translating the protocol scheme does not validate the underlying connection metadata, instead defaulting to a state that does not accurately reflect the secure or insecure nature of the transport.\nThe attack flow commences when an attacker identifies an endpoint protected by logic that explicitly checks request.isSecure(). Because the function implementation does not conduct a cryptographically sound or infrastructure-backed check of the transport protocol, the method may return a value that misrepresents the connection status. An attacker can transmit an HTTP request to the target function; if the function relies on the return value of isSecure() to decide whether to process sensitive credentials or perform secure operations, it will proceed as if the channel is encrypted, even if it is not.\nExploitation requires no specific privileges or authentication beyond the ability to reach the deployed function endpoint. The impact is significant in architectures where the function assumes the infrastructure has already performed SSL/TLS termination, but the application layer relies on the request object's metadata to enforce security policies. If the application logic is conditioned on isSecure() to prevent the transit of sensitive session identifiers or PII, a successful exploitation allows an attacker to intercept such traffic in cleartext. Furthermore, this flaw can undermine compliance requirements that demand strict adherence to TLS-only communication paths, effectively downgrading the security posture of the entire serverless application stack by bypassing application-level transport verification."
}