CVE-2025-22235: Spring Boot EndpointRequest.to() Authentication Bypass Vulnerability Demo

Vulnerability Description

CVE-2025-22235 is a Spring Boot security vulnerability involving the EndpointRequest.to() method, which may generate an incorrect matcher when configuring security rules, leading to the security protection failing for non-exposed actuator endpoint paths (such as /null/**).

Affected Versions

• Spring Security 5.7.16
• Spring Security 5.8.18
• Spring Security 6.0.16
• Spring Security 6.1.14
• Spring Security 6.2.10
• Spring Security 6.3.8
• Spring Security 6.4.4
• Older, unsupported versions are also affected

Vulnerability Principle

When using EndpointRequest.to("health") to configure security rules, if the health endpoint is not configured in management.endpoints.web.exposure.include, Spring Boot generates an incorrect path matcher /null/**, causing all requests under that path to bypass authentication checks.

Environment Setup

1. Project Dependencies

• Spring Boot 3.4.3 (vulnerable version)
• Spring Security
• Spring Boot Actuator

2. Key Configuration

• management.endpoints.web.exposure.include=info (only the info endpoint is exposed, the health endpoint is not exposed)
• The security configuration uses EndpointRequest.to("health") to reference a non-exposed endpoint

Vulnerability Reproduction Steps

1. Start the Application

mvn spring-boot:run

2. Access the Protected Endpoint

Visit http://localhost:8080/null directly – it can be accessed without login, confirming an authentication bypass vulnerability exists.

3. Normal Authentication Flow

Accessing other protected endpoints such as http://localhost:8080/info will require login.

Vulnerability Code Analysis

Security Configuration Class (SecurityConfig.java)

.requestMatchers(EndpointRequest.to("health")).permitAll()  // Vulnerability trigger point
.requestMatchers("/null").authenticated()                   // Should be protected but bypassed

Controller (DemoController.java)

@GetMapping("/null")
public String sensitiveEndpoint() {
    return "Seeing this page without login indicates the CVE-2025-22235 authentication bypass vulnerability!";
}

Vulnerability Fix

1. Upgrade Spring Boot Version

Upgrade to the following fixed versions:

• 3.4.5+
• 3.3.11+
• Other supported latest versions

2. Temporary Mitigation Measures

• Ensure that the endpoint referenced by EndpointRequest.to() is enabled and exposed via the web
• Avoid handling requests to the /null path
• Check whether all endpoints referenced in the security configuration are properly exposed

Technical Details

The root cause of the vulnerability is that the EndpointRequest.to() method generates an incorrect path matcher when processing a non-exposed endpoint. When the endpoint name is not configured in management.endpoints.web.exposure.include, Spring Boot creates a path pattern containing null, causing the security rule to become invalid.

References

• CVE-2025-22235 Official Announcement
• Spring Boot Official Security Advisory
• Spring Security Official Documentation

Disclaimer

This demonstration project is for security research and educational purposes only. Do not use it in production environments. All risks arising from using this project are borne by the user.