API8:2023 — Security Misconfiguration

Slide 12 · Pattern 2 Mechanics

Admin endpoint discovery → No auth → Full access

How attackers find and exploit unauthenticated admin and debug endpoints.

THE SETUP

A Spring Boot API with Actuator endpoints deployed to production.

Spring Boot Actuator is a production-ready features framework. In development, the /actuator endpoint is enabled with all sub-endpoints exposed for debugging. The configuration is not locked down before production deployment.

Exposed endpoints include: /actuator/env (all environment variables, including secrets), /actuator/heapdump (full JVM heap dump — contains everything in memory), /actuator/beans (all Spring beans and configuration), /actuator/mappings (all URL route mappings).

1️⃣

Attacker scans for common admin paths

Automated scanner (or manual attempt) tries: /admin, /actuator, /actuator/health, /debug, /console, /metrics, /.env, /swagger-ui. Finds /actuator returns HTTP 200.

2️⃣

Attacker fetches /actuator/env

Response contains: SPRING_DATASOURCE_PASSWORD: prod-db-pass-2024, AWS_SECRET_ACCESS_KEY: AKIA..., STRIPE_SECRET_KEY: sk_live_.... All production secrets exposed in plain JSON.

3️⃣

Attacker fetches /actuator/heapdump

Downloads a binary heap dump of the JVM memory. Parsed with standard tools, it contains: session tokens, decrypted secrets, database query results still in memory, user data cached in application. Everything the application has touched.

The heapdump is the worst one

The JVM heap dump is particularly dangerous because it contains the decrypted form of everything in memory. Even if secrets are stored encrypted in environment variables, they are decrypted when used — and those decrypted values live in the heap. The heapdump is essentially a snapshot of everything the application currently knows.

← Back Real incident: Firebase →