Security Test: Springboot Actuator Disclosure of Mappings¶

Description¶

Default Severity: high

Spring Boot Actuator Disclosure of Mappings happens when your app unintentionally reveals internal details about its endpoints and how it's put together. This happens mostly because the default settings or misconfigurations expose sensitive mappings that were meant to stay hidden. An attacker who sees these details can figure out where exactly to target your app, making it easier to discover other weaknesses. Developers often trip up by assuming that the default configurations protect these endpoints, leaving the door open for attackers to use that internal information as a starting point for exploiting the app.

Configuration¶

Identifier: information_disclosure/springboot_actuator_mappings

Examples¶

All configuration available:

checks:
  information_disclosure/springboot_actuator_mappings:
    skip: false # default

Compliance and Standards¶