Spring Boot Actuator Misconfigurations Can Expose Secrets and Enable RCE
Summary
Wiz reports misconfigured, publicly exposed Spring Boot Actuator instances in 24% of environments with exposed Actuators. The article explains risks including secret exposure, SSRF, and conditional RCE, and recommends restricting access and disabling sensitive endpoints
Key points
- Wiz says 24% of cloud environments with publicly exposed Actuators had misconfigured instances detected; 60% of cloud environments had at least one Actuator instance.
- Unauthenticated heapdump and env endpoints can expose credentials, tokens, and other sensitive runtime data.
- An exposed Gateway endpoint can enable SSRF; with IMDSv1 enabled, an attacker may retrieve instance credentials from the cloud metadata service.
- CVE-2022-22947 can enable RCE when the Gateway endpoint is publicly exposed without authentication and the application uses a vulnerable Spring Cloud Gateway version.
- The article says it knows of no widely documented real-world exploitation of the specific heapdump or env misconfigurations discussed.
- Recommended defenses include authenticating and restricting access to Actuator endpoints, disabling or excluding sensitive endpoints, and keeping Actuator and related libraries updated.
Article Details
- Topic
- Security risks from publicly exposed or misconfigured Spring Boot Actuator endpoints, including credential disclosure, SSRF, and potential remote code execution.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe article describes exploiting a vulnerable Spring Cloud Gateway endpoint exposed to the public internet to execute code remotely.T1552.005 · Cloud Instance Metadata APIThe article demonstrates retrieving AWS credentials from the cloud instance metadata service through an exposed gateway endpoint.
CVE
Vendors
Amazon Web ServicesAWS Access and Secret Keys: Search for AWS key patterns within the heap dump: WizAccording to Wiz data, 60% precent of cloud environments have at least one instance of Spring Boot Actuator, while 11% of such environments have instances that are publicly exposed to the Internet, and 24% of
Products
EC2In this proof of concept, we used an EC2 instance configured with IMDSv1, which allowed us to successfully retrieve security credentials via the metadata service.Spring BootSpring Boot Actuator is widely used for Java application observability, found in over 60% of cloud environments, but its exposure can lead to serious security risks when misconfigured. These misconfigurations can leadSpring Boot ActuatorSpring Boot Actuator is widely used for Java application observability, found in over 60% of cloud environments, but its exposure can lead to serious security risks when misconfigured. These misconfigurations can leadSpring Cloud GatewaySpring Boot applications using Spring Cloud Gateway versions 3.1.0, 3.0.0 to 3.0.6, and older unsupported versions are vulnerable to remote code execution (CVE-2022-22947). Wiz Dynamic ScannerInternet, and 24% of environments with exposed Actuators have misconfigured instances detected by Wiz Dynamic Scanner.