Spring Boot Actuator Exposure: heapdump, env, and Gateway Leaks

Spring Boot Actuator Exposure: heapdump, env, and Gateway Leaks

Actuator is operations gold and hunter candy. Teams enable it for health checks, then forget management.endpoints.web.exposure.include on the public listener. Suddenly /actuator/env and friends answer without auth.

Stop. You do not need to download a production heapdump to prove the issue on day one — and many policies forbid it.

Endpoints that matter

Common base paths: /actuator, /manage, sometimes on a separate management port. High-signal IDs:

• env, configprops — properties, sometimes secrets in plain form
• heapdump — memory snapshot (handle as Critical if reachable; fetch only if explicitly allowed)
• mappings, beans — attack surface map
• logfile, threaddump — operational data
• gateway/routes on Spring Cloud Gateway — internal routes
• jolokia — dangerous if writable operations exist
• prometheus / metrics — lower severity alone, useful recon when labels leak tenant IDs

health alone is usually out of scope or Informational. env with DB passwords is not. Older Boot 1.x apps used different path layouts (/env at root); try both eras when fingerprints look legacy.

Safe confirmation

1. GET /actuator (or discovered base) — list available IDs.
2. Request low-risk read endpoints first (info, health, mappings).
3. For env, show a redacted snippet proving secret-bearing keys exist (mask values).
4. Check auth: unauthenticated vs authenticated low-priv user vs admin.
5. Note whether management runs on another port (e.g. 8081) exposed by mistake via the same hostname mapping.

If heapdump is listed, report reachability + sensitivity. Ask the program before downloading; many prefer a HEAD/GET that returns application/octet-stream with a small byte sample. Never post heapdumps to public issue trackers.

False positives and footguns

• Actuator bound to localhost only (you hit it via an open SSH tunnel you created — out of scope)
• Separate management port not exposed publicly
• Endpoints require Spring Security roles you do not have — still note if the role is too broad
• Older apps with custom scrubbing — verify values are actually sensitive
• health showing disk space without secrets — usually won’t pay

Do not invoke shutdown, restart, or Jolokia write ops on production. Read-only proof is enough for disclosure severity.

Report shape

URL, unauthenticated response proving exposure, redacted secret evidence, and remediation: expose only health (and maybe info) publicly, secure management endpoints with network policy + auth, disable heapdump externally, scrub secrets from env. Prefer a dedicated management network over “security through obscure paths.”

Official reference: Spring Boot Actuator. Pair with CWE-200 when framing disclosure. If gateway routes appear, explain how they expand SSRF or internal pivoting risk without scanning the whole internal net.

When env shows cloud credentials, rotate guidance belongs in the remediation section — programs need a clear “assume these keys leaked” checklist, not just “turn Actuator off.”