CodeQL query to detect open Spring Boot actuator endpoints

[ggolawski]

CVE ID(s)

There's no CVE for this.

Report

I created a query to detect open (unauthenticated) Spring Boot actuators that can lead to sensitive information disclosure or even RCE.

The details are present in PR: github/codeql#2901

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

[ggolawski]

github/codeql#2901 is aleady merged. Is there anything else I need to do?

[xcorail]

Created Hackerone report 891266 for bounty 221136 : [42] CodeQL query to detect open Spring Boot actuator endpoints
🎉

[ggolawski]

Thank you, @xcorail.

[lincoln9932]

Big huy