Skip to content

Sensitive Information Disclosure #79

@NinjaGPT

Description

@NinjaGPT

Summary

In the latest version 6.0.0, all microservices' Spring Actuator interfaces have no access control whatsoever, allowing any user to access and obtain various configurations, environment variables, and other sensitive information of the corresponding services.


POC

http://localhost:{port}/actuator

such as:
http://localhost:9900/actuator
http://localhost:7200/actuator
Image Image Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions