Sensitive Spring Boot Actuator Endpoints Exposed

ID

java.actuator_endpoints_exposed

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

Java

Tags

ASVS50:v13.4.5, CWE:200, NIST.SP.800-53, OWASP:2025:A05, spring

Description

Spring Boot Actuator publishes management endpoints for operating an application. Web exposure is opt-in per endpoint through management.endpoints.web.exposure.include, and this detector reports the configurations that publish endpoints whose payload is sensitive:

  • include: "*", which exposes every endpoint, including the ones below;

  • an explicit include of env or configprops (the resolved configuration), heapdump or threaddump (process memory), shutdown, beans, mappings, loggers, auditevents, httpexchanges, sessions or scheduledtasks;

  • management.endpoint.shutdown.enabled: true;

  • management.security.enabled: false, the Spring Boot 1.x switch that publishes every endpoint anonymously.

The configuration is read from the project’s Spring property sources (application.yml, application.properties, their per-profile variants and bootstrap.*), which are recognised only when they really are Spring configuration — a Kubernetes or Argo CD manifest named application.yaml is not.

Exposing only health, info or metrics — the common and intended case — is not reported, and an endpoint listed in management.endpoints.web.exposure.exclude is discounted.

Rationale

env and configprops return the resolved configuration of the running application. Spring masks values for keys it recognises as sensitive, but the masking is name-based, so anything the application injects under an unrecognised key is returned verbatim — database URLs, internal hostnames, tokens passed through the environment. heapdump returns a snapshot of process memory, which contains every secret the application has loaded regardless of masking, and threaddump leaks internal structure and in-flight data. shutdown stops the application through a plain HTTP request.

Whether these endpoints are reachable anonymously depends on the Spring Security configuration, which is not visible in the property source. The finding therefore identifies configuration that must be justified and protected, and CWE-200 applies whenever the exposure is not intended.

Monitoring endpoints are called out explicitly by OWASP ASVS 5.0 V13.4.5: "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended."

Remediation

Expose only the endpoints that are operationally needed:

management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics
  endpoint:
    shutdown:
      enabled: false

Then, for anything beyond health:

  • move the management endpoints to a separate, non-public port (management.server.port) reachable only from the monitoring network;

  • require authentication and an operator role for /actuator/** in the Spring Security configuration;

  • keep shutdown disabled — use the platform’s lifecycle instead of an HTTP endpoint.

References