Information Disclosure: Springboot Actuator Disclosure of Mappings¶

Identifier: springboot_actuator_mappings

Scanner(s) Support¶

Description¶

Spring Boot Actuator Disclosure of Mappings happens when your app unintentionally reveals internal details about its endpoints and how it's put together. This happens mostly because the default settings or misconfigurations expose sensitive mappings that were meant to stay hidden. An attacker who sees these details can figure out where exactly to target your app, making it easier to discover other weaknesses. Developers often trip up by assuming that the default configurations protect these endpoints, leaving the door open for attackers to use that internal information as a starting point for exploiting the app.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  springboot_actuator_mappings:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.