Detections
Analytics

Spring Boot Actuator Sensitive Endpoints Detected

medium Web App Scanning Plugin ID 113205

Language:

Synopsis

Spring Boot Actuator Sensitive Endpoints Detected

Description

Spring Boot Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the 'health' endpoint provides basic application health information. But some of these endpoints are considered sensitive and may allow an unauthenticated attacker to access sensitive information.

Solution

Disable unnecessary endpoints and do not make sensitive endpoints externally accessible ('env', 'configprops', 'heapdump', 'restart', 'shutdown'), limiting access to known IP Addresses.

See Also

https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.enabling

Plugin Details

Severity: Medium

ID: 113205

Type: remote

Published: 3/24/2022

Updated: 3/13/2023

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 1.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

Reference Information