Security Test: Springboot Actuator Shutdown Misconfiguration¶

Description¶

Default Severity: high

Spring Boot Actuator includes management endpoints, one of which lets you shut the application down gracefully. The issue arises when this shutdown endpoint—or other sensitive ones that expose internal details—is unintentionally left accessible over the network in a production environment. When that happens, an attacker could trigger a shutdown, effectively causing a denial of service. It’s a reminder that default configurations or misconfigured security rules can expose dangerous functionality, putting your application at risk of disruption or even further exploitation if other sensitive endpoints are similarly exposed.

Configuration¶

Identifier: configuration/springboot_actuator_shutdown

Examples¶

All configuration available:

checks:
  configuration/springboot_actuator_shutdown:
    skip: false # default

Compliance and Standards¶