Security Test: Springboot Actuator Disclosure of Environment¶

Description¶

Default Severity: medium

The issue arises when Spring Boot apps leave physical keys open by exposing an actuator endpoint that shows sensitive details about the environment and configuration. This can give attackers insights into your system, such as internal settings and credentials, which they might use to launch further attacks. Developers often overlook restricting access to these endpoints or turning them off in production, and that oversight can lead to information leaks that jeopardize the entire application.

Configuration¶

Identifier: information_disclosure/springboot_actuator_env

Examples¶

All configuration available:

checks:
  information_disclosure/springboot_actuator_env:
    skip: false # default

Compliance and Standards¶