Attacking Misconfigured Spring Boot Actuators

In this story I'll write about spring boot actuators. I'll explain the components and we will see Hackerone reports about it. It's very important and easy to gain critical information about system.

Actuators are Spring Boot feature to help monitor and control application.

/actuator/env
/actuator/auditevents
/actuator/beans
/actuator/caches
/actuator/configprops
/actuator/flyway
/actuator/health
/actuator/heapdump
/actuator/httptrace
/actuator/info
/actuator/integrationgraph
/actuator/liquibase
/actuator/configprops
/actuator/shutdown

Environment and heapdump endpoints are really critical because they have a lot of critical information about your systems. In first step you should make a good recon about your target, I'll show you 3 tools for this but you can add more than of course.

Recon

Subdomain Enumaration with & ;

subfinder -d sony.com | httpx 

https://accurateplayer-validate.mc.spe.sony.com
https://adfs.eu.sony.com
https://adfs.sony.com
https://admin.servicesplus.sel.sony.com
https://ack.me.sony.com
https://1afx.spe.sony.com
https://alertspe.spe.sony.com
https://adl.vpn.sie.sony.com
https://am.vpn.sie.sony.com
...
...
...
...

Then you can use to brute endpoints to get hidden actuator endpoints. Also you can use my with specific wordlist to fuzz every sub endpoint before do this don't forget to use . Sometimes actuators can be https[:]//test.com/test/api/<here> so you should fuzz every endpoint you have, not only main one.

I'll show another method with using shodan. When you calculate favicon hash of spring boot you'll get : 116323821 Then you can use this query in shodan http.favicon.hash:116323821

To get favicon hash you can use this block of code;

import mmh3 import requests import codecs response = requests.get('https://test.com/favicon.ico') favicon = codecs.encode(response.content,"base64") hash = mmh3.hash(favicon) print(hash)

169,911 instances

Exploit

When you found a heapdump file you can use to monitor this file.

That was a bug which I found 3 years ago;

Others;

Some of critical reports about spring boot actuators from ;

Thanks for reading, stay secure ❤