Security Test: Springboot Actuator Disclosure of Heap Dump¶

Description¶

Default Severity: high

The vulnerability happens when the actuator endpoint for generating heap dumps is left open and accessible without proper authorization. A heap dump is basically a snapshot of all the data in a running application, which means it can contain sensitive details like passwords, class names, and configuration settings. If an attacker gets access to this information, they could uncover secrets about your application's structure and behavior, making it easier to craft targeted attacks. This issue usually arises from misconfigurations or neglecting to secure these debug and management endpoints. If left unchecked, it exposes your application to significant risks including data breaches and unauthorized system manipulation.

Configuration¶

Identifier: information_disclosure/springboot_actuator_heapdump

Examples¶

All configuration available:

checks:
  information_disclosure/springboot_actuator_heapdump:
    skip: false # default

Compliance and Standards¶