Exposed Spring Boot Actuator and Stolen Credentials Enable SharePoint Data Theft
Summary
Attackers used information exposed by unauthenticated Spring Boot Actuator endpoints and credentials stored in a spreadsheet to authenticate via ROPC without MFA, access SharePoint Online, and exfiltrate data.
Key points
- Unauthenticated Spring Boot Actuator endpoints exposed configuration details that identified a SharePoint service account and where its credentials were stored.
- A spreadsheet contained plaintext client credentials for an internal Azure AD application; investigators also identified the SharePoint account password in application configuration.
- Attackers used the ROPC authentication flow with the stolen credentials to obtain a Microsoft Graph access token without an additional MFA challenge.
- Logs showed SharePoint site access, document library enumeration, and file downloads consistent with data exfiltration.
- The investigation found no evidence of malware deployment or software exploitation; the attackers used valid credentials and API access.
- Recommended mitigations include restricting Actuator endpoints, removing and rotating exposed secrets, and disabling ROPC in favor of modern authentication controls.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Credential abuse leading to unauthorized SharePoint access and data exfiltration
- Disclosure Date
- 2026-03-18
- Data Types Exposed
- SharePoint files; specific data types were not disclosed
- Operational Impact
- The attacker used valid credentials and a Microsoft Graph access token to access SharePoint resources, enumerate document libraries, and download files. The investigation found no evidence of malware deployment or software exploitation.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Vendors
Products
Azure ADThe spreadsheet contained credentials related to the internal Azure AD application, which we will refer to as "[REDACTED]-2024" in this entry, specifically the following values:Entra ID1. An application sends to the identity provider (Azure AD/Entra ID) a request containing the:Microsoft GraphMicrosoft GraphSharePoint OnlineThese weaknesses ultimately allowed attackers to compromise a SharePoint service account of the target organization and exfiltrate data from SharePoint Online.Spring BootFrom Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA