Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected Spring Products and Versions

Spring Cloud Gateway:

• 3.1.x
• 4.1.x
• 4.2.x
• 4.3.x
• 5.0.x
• Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

As part of this fix, the Spring Cloud Gateway Server WebFlux NettyServerCustomizer has been disabled by default. If you require this to be enabled, please set spring.cloud.gateway.server.webflux.httpserver.customizer-enabled=true for versions 5.0.x or 4.3.x if you have migrated to the new properties namespace, or spring.cloud.gateway.httpserver.customizer-enabled=true for 4.3.x if you have not migrated to the new properties namespace and for 4.2.x and 3.1.x.

Credit

The issue was identified and responsibly reported by samarthd.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N&version=3.1