Security Test: Springboot Actuator Restart Misconfiguration¶

Description¶

Default Severity: high

The vulnerability happens when developers leave the Actuator restart endpoint exposed without proper security controls. An attacker can trigger an application restart, which might open the door to other attacks—causing downtime or revealing internal details of how the app is configured and managed. Often, this misconfiguration occurs when sensitive endpoints are enabled in production, usually to help with debugging during development, but then not locked down when the app goes live. The impact can be severe, leading not only to disruption of services but also to further exploitation by attackers who gather more insights about the system.

Configuration¶

Identifier: configuration/springboot_actuator_restart

Examples¶

All configuration available:

checks:
  configuration/springboot_actuator_restart:
    skip: false # default

Compliance and Standards¶