Ankur Mhatre
4b6cefa60a
Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
40 lines
1.8 KiB
Plaintext
40 lines
1.8 KiB
Plaintext
### profiles: exposeall,open -- NO credentials are sent on any request below
|
|
|
|
--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---
|
|
$ curl -s http://localhost:8080/actuator/env/spring.datasource.password | jq .property
|
|
{
|
|
"source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
|
|
"value": "******"
|
|
}
|
|
$ curl -s http://localhost:8080/actuator/env/acme.partner.credential | jq .property
|
|
{
|
|
"source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
|
|
"value": "******"
|
|
}
|
|
|
|
Note the second one. 'acme.partner.credential' matches none of the classic
|
|
password/secret/token key patterns, and it is still masked. Masking is driven by
|
|
management.endpoint.env.show-values, which defaults to 'never' - not by key names.
|
|
|
|
--- 2. /actuator/heapdump is NOT exposed by 'include: "*"' ---
|
|
$ curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/heapdump
|
|
404
|
|
management.endpoint.heapdump.access defaults to 'none'. So does shutdown.
|
|
They are the only two endpoints that do.
|
|
|
|
--- 3. /actuator/loggers: an unauthenticated WRITE ---
|
|
$ curl -s -X POST -d '{"configuredLevel":"TRACE"}' -H 'Content-Type: application/json' http://localhost:8080/actuator/loggers/org.springframework
|
|
status=204
|
|
$ curl -s http://localhost:8080/actuator/loggers/org.springframework
|
|
{
|
|
"configuredLevel": "TRACE",
|
|
"effectiveLevel": "TRACE"
|
|
}
|
|
(level reset). An attacker who can flip your root logger to TRACE has both a
|
|
denial-of-service primitive and a way to get request bodies written to disk.
|
|
|
|
--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---
|
|
$ curl -s http://localhost:8080/actuator/mappings | python3 -c 'count the URL patterns'
|
|
30 servlet mappings disclosed
|
|
426 beans disclosed, each with its type and dependencies
|