Spring Boot Actuator Wildcard Exposure in 2021.04 Provisioning

Affected Versions

The Vulnerability Explained

Spring Boot Actuator provides production-ready operational endpoints for monitoring and managing applications. The management.endpoints.web.exposure.include property controls which of these endpoints are accessible via HTTP. When set to the wildcard value '*', every Actuator endpoint becomes reachable—including those designed for diagnostic access that leak sensitive runtime state.

The vulnerable configuration:

management:
  endpoints:
    web:
      exposure:
        include: '*'

This single line exposed the application's internals without authentication. An attacker—or anyone with network access—could retrieve:

• /actuator/env: Environment variables, including database credentials, API keys, and secrets injected through SPRING_APPLICATION_JSON or shell environment
• /actuator/logfile: The complete application log stream, potentially containing PII, session identifiers, or authentication tokens
• /actuator/heapdump: A binary dump of the entire JVM heap, extractable offline to recover in-memory secrets, session objects, and cryptographic material
• /actuator/threaddump: Live thread state revealing internal request handling, synchronization patterns, and potentially sensitive data on stack frames

The provisioning template's purpose—automated Vagrant environment setup—meant this configuration propagated to development and potentially staging deployments. While production might layer additional network controls, the configuration itself assumed no authentication boundary existed.

The Fix

The remediation replaces the wildcard with an explicit allowlist:

management:
  endpoints:
    web:
      exposure:
        include: 'health,info'

This change implements two critical boundaries:

1. Principle of least exposure: Only health and info endpoints remain reachable. The health endpoint provides binary up/down status and basic health indicators; info exposes static build metadata—neither reveals runtime secrets or mutable state.

2. Fail-closed configuration: Future Actuator endpoints added by Spring Boot upgrades won't automatically expose themselves. The explicit list requires conscious review to expand.

The health endpoint remains valuable for load balancer health checks and container orchestration probes without authentication. The info endpoint supports deployment verification through static properties like build.version and build.time. All diagnostic and sensitive operations now require explicit reconfiguration or alternative access mechanisms (JMX, authenticated HTTP, or direct JVM attachment).

Key Takeaways

• Wildcard exposure in Actuator is never safe for network-facing services: The '*' value was designed for local development with JMX or no security context. Any YAML configuration setting this value on management.endpoints.web.exposure.include requires immediate audit.

• Provisioning templates are production code: Infrastructure-as-code configurations propagate to real environments. The application-2021.04.yaml template served automated deployment, making its security properties binding on all generated instances.

• Actuator endpoints have asymmetric sensitivity: health and info are intentionally safe for unauthenticated access; env, heapdump, and logfile assume privileged access. Mixing these in wildcard exposure ignores this design boundary.

• Defense-in-depth applies to configuration: Even where network segmentation might limit exploitability, explicit endpoint restrictions prevent configuration drift from becoming vulnerability exposure.

How Orbis AppSec Detected This

Orbis AppSec identified this vulnerability through static analysis of YAML configuration files:

The detection pattern matches Spring Boot configuration properties where management.endpoints.web.exposure.include contains '*' without accompanying management.server.port isolation or spring.security authentication requirements.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

The include: '*' pattern in Spring Boot Actuator configuration represents a silent security regression—functional for operations, catastrophic for confidentiality. This fix in the ArkCase 2021.04 provisioning template demonstrates that configuration hygiene matters as much as code security. Explicit endpoint exposure, not wildcard convenience, should govern production-ready Spring Boot deployments.