Ankur Mhatre
4b6cefa60a
Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
54 lines
2.8 KiB
Bash
Executable File
54 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# What an unauthenticated caller actually gets when exposure is "*" and the chain permits all.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
OUT=docs/output/03-open-actuator-leak.txt
|
|
B=http://localhost:8080/actuator
|
|
{
|
|
echo "### profiles: exposeall,open -- NO credentials are sent on any request below"
|
|
echo
|
|
echo "--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---"
|
|
echo "\$ curl -s $B/env/spring.datasource.password | jq .property"
|
|
curl -s "$B/env/spring.datasource.password" | python3 -c 'import json,sys;print(json.dumps(json.load(sys.stdin)["property"],indent=2))'
|
|
echo "\$ curl -s $B/env/acme.partner.credential | jq .property"
|
|
curl -s "$B/env/acme.partner.credential" | python3 -c 'import json,sys;print(json.dumps(json.load(sys.stdin)["property"],indent=2))'
|
|
echo
|
|
echo " Note the second one. 'acme.partner.credential' matches none of the classic"
|
|
echo " password/secret/token key patterns, and it is still masked. Masking is driven by"
|
|
echo " management.endpoint.env.show-values, which defaults to 'never' - not by key names."
|
|
echo
|
|
echo "--- 2. /actuator/heapdump is NOT exposed by 'include: \"*\"' ---"
|
|
echo "\$ curl -s -o /dev/null -w '%{http_code}' $B/heapdump"
|
|
curl -s -o /dev/null -w '%{http_code}\n' "$B/heapdump"
|
|
echo " management.endpoint.heapdump.access defaults to 'none'. So does shutdown."
|
|
echo " They are the only two endpoints that do."
|
|
echo
|
|
echo "--- 3. /actuator/loggers: an unauthenticated WRITE ---"
|
|
echo "\$ curl -s -X POST -d '{\"configuredLevel\":\"TRACE\"}' -H 'Content-Type: application/json' $B/loggers/org.springframework"
|
|
curl -s -o /dev/null -w ' status=%{http_code}\n' -X POST -H 'Content-Type: application/json' \
|
|
-d '{"configuredLevel":"TRACE"}' "$B/loggers/org.springframework"
|
|
echo "\$ curl -s $B/loggers/org.springframework"
|
|
curl -s "$B/loggers/org.springframework" | python3 -m json.tool
|
|
curl -s -o /dev/null -X POST -H 'Content-Type: application/json' \
|
|
-d '{"configuredLevel":null}' "$B/loggers/org.springframework"
|
|
echo " (level reset). An attacker who can flip your root logger to TRACE has both a"
|
|
echo " denial-of-service primitive and a way to get request bodies written to disk."
|
|
echo
|
|
echo "--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---"
|
|
echo "\$ curl -s $B/mappings | python3 -c 'count the URL patterns'"
|
|
curl -s "$B/mappings" | python3 -c '
|
|
import json,sys
|
|
d=json.load(sys.stdin)
|
|
n=0
|
|
for ctx in d["contexts"].values():
|
|
for m in ctx["mappings"].get("dispatcherServlets",{}).values():
|
|
n+=len(m)
|
|
print(f" {n} servlet mappings disclosed")'
|
|
curl -s "$B/beans" | python3 -c '
|
|
import json,sys
|
|
d=json.load(sys.stdin)
|
|
n=sum(len(c["beans"]) for c in d["contexts"].values())
|
|
print(f" {n} beans disclosed, each with its type and dependencies")'
|
|
} > "$OUT" 2>&1
|
|
echo "wrote $OUT"
|