Security Test: Springboot Actuator Disclosure of Trace¶

Description¶

Default Severity: high

Spring Boot Actuator can expose sensitive details about your application if it's not properly secured. By default, certain endpoints might share information like environment settings, configuration details, and traces of recent requests that include internal workings of your app. If attackers get access to this data, they could learn about system details and potentially identify weaknesses to exploit. Developers often forget to restrict these endpoints in production settings, leaving their systems open to risk.

Configuration¶

Identifier: information_disclosure/springboot_actuator_trace

Examples¶

All configuration available:

checks:
  information_disclosure/springboot_actuator_trace:
    skip: false # default

Compliance and Standards¶