Java Spring Boot "heapdump" scans, (Mon, Jul 27th)
A vulnerability in Spring Boot applications exposes a heapdump endpoint that, by default, contains sensitive data like API keys and database passwords. Attackers are leveraging a weak default username/password combination to gain access to these dumps, highlighting a critical security oversight in Spring Boot deployments.
Spring Boot applications expose a `/actuator/heapdump` endpoint designed to collect debug information. This endpoint generates a `heapdump.hprof` file, a binary representation of the application's memory at a specific point in time. This file can be used to analyze the application's state, but it also frequently includes sensitive data, such as API keys and database passwords, which are stored within the application's memory. The vulnerability stems from the fact that the endpoint is exposed by default and relies on a weak default username/password combination – ‘admin:admin’ – which is easily guessed. The attacker is using a modified URL, `/admin-api/actuator/heapdump`, to access this endpoint. Spring Boot configuration allows for the management endpoints to be accessed via `/admin-api/actuator`, and this configuration should be reviewed and secured using Spring Security.