Executive brief
Spring Cloud Gateway is a reverse proxy and API gateway used to route and manage network traffic in microservice architectures. The JsonToGrpcGatewayFilterFactory component allows an attacker to specify arbitrary Spring Resource locations when defining protobuf descriptor files, potentially enabling unauthorized file access or information disclosure on the server hosting the gateway.
Technical details
The vulnerability exists in the JsonToGrpcGatewayFilterFactory class, which fails to properly validate and restrict Spring Resource locations used for loading protobuf (proto) descriptor files. An attacker can craft requests that specify arbitrary resource paths (such as file://, classpath:/, or other Spring resource protocols) to access unintended files on the system. The vulnerability requires network access to the affected gateway endpoint and does not require prior authentication. By exploiting this, an attacker can read sensitive files or gain insight into the application's configuration and classpath resources.
Affected products
- VMware Spring Cloud Gateway 5.0.0 through 5.0.2, 4.3.0 through 4.3.5, 4.0.0 through 4.2.9, and 3.1.13 and earlier
Timeline
- 2026-08-27: disclosed