GitHub Security Lab: CodeQL query to detect open Spring Boot actuator endpoints

This bug was reported directly to GitHub Security Lab...

LY Corporation: Spring Actuator endpoints publicly available, leading to account takeover

Due to insufficient access controls, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. The /heapdump endpoint leaks data from the Java Virtual Machine, leading to disclosure of admin credentials, user tokens and a combination of other data. This endpoint was not...

LY Corporation: Spring Actuator endpoints publicly available and broken authentication

Due to insufficient access control, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. @kazan71p identified two highly sensitive applications leaking information through these endpoints. The LINE Security team shutdown the secondary endpoints just as it was discovere...

Design/Logic Flaw

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent...

CVE-2019-11276: Cleartext Transmission of Sensitive Information

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent...

Spring Boot Actuator Command Execution Vulnerability

Actuators are one of the four main features proposed in Spring Boot to simplify Spring development. A command execution vulnerability exists in Spring Boot Actuator, which can be exploited by an attacker to execute arbitrary commands by constructing a malicious request...

Spring Boot Actuator Module Command Execution Vulnerability

Spring Boot Acuatorr can help you monitor and manage your Spring Boot applications, such as health checks, auditing, statistics and HTTP tracing. A command execution vulnerability exists in the Spring Boot Actuator module. The vulnerability is realized by using JNDI through Spring Boot Actuator's...

Comelit Actuator Detection

Binary data comelitactuatorsdetect.nbin...

WS-2016-7111

In Spring Boot, versions 1.0.0.RELEASE through 1.4.7.RELEASE are vulnerable to Improper Access Control. As part of the actuator feature, a Spring Boot app registers endpoints which can help developers to monitor their app while running. However, affected versions of Spring Boot permit...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the drivers/media/platform/msm/camerav2/sensor/actuator/msmactuator.c component of Qualcomm’s Android operating system is related to improper handling of user interface elements. Exploiting this vulnerability can allow a malicious actor to increase their privileges through a...

Android on Nexus Qualcomm Component Privilege Acquisition Vulnerability (CNVD-2016-06247)

Android on Nexus 5 and 7 is an open source Linux-based operating system for the Nexus 5 and 7 smartphones developed by Google and the Open Handset Alliance OHA in the U.S. Qualcomm is one of the U.S.-based companies used in the Qualcomm devices. Qualcomm is a Qualcomm device-specific component us...

UBUNTU-CVE-2014-9877

drivers/media/platform/msm/camerav2/sensor/actuator/msmactuator.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 2013 devices mishandles a user-space pointer, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28768281 and...

Android Qualcomm component lifting vulnerability (CNVD-2016-04855)

Android on Nexus 5 and 7 is an open source Linux-based operating system for the Nexus 5 and 7 smartphones developed by Google and the Open Handset Alliance OHA in the U.S. Qualcomm is one of the U.S.-based companies used in the Qualcomm devices. Qualcomm is a Qualcomm device-specific component us...

Android Qualcomm Component Heap Buffer Overflow Vulnerability

Android on Nexus 5 and 7 is an open source Linux-based operating system for the Nexus 5 and 7 smartphones developed by Google and the Open Handset Alliance OHA in the U.S. Qualcomm is one of the U.S.-based companies that use Qualcomm components for their devices. Qualcomm is a Qualcomm...