mirror of
https://github.com/github/codeql.git
synced 2026-02-27 04:13:51 +01:00
40 lines
1.7 KiB
XML
40 lines
1.7 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
||
"-//Semmle//qhelp//EN"
|
||
"qhelp.dtd">
|
||
<qhelp>
|
||
<overview>
|
||
<p>Spring Boot includes a number of additional features called actuators that let you monitor
|
||
and interact with your web application. Exposing unprotected actuator endpoints via JXM or HTTP
|
||
can, however, lead to information disclosure or even to remote code execution vulnerability.</p>
|
||
</overview>
|
||
|
||
<recommendation>
|
||
<p>Since actuator endpoints may contain sensitive information, careful consideration should be
|
||
given about when to expose them. You should take care to secure exposed HTTP endpoints in the same
|
||
way that you would any other sensitive URL. If Spring Security is present, endpoints are secured by
|
||
default using Spring Security’s content-negotiation strategy. If you wish to configure custom
|
||
security for HTTP endpoints, for example, only allow users with a certain role to access them,
|
||
Spring Boot provides some convenient <code>RequestMatcher</code> objects that can be used in
|
||
combination with Spring Security.</p>
|
||
</recommendation>
|
||
|
||
<example>
|
||
<p>In the first example, the custom security configuration allows unauthenticated access to all
|
||
actuator endpoints. This may lead to sensitive information disclosure and should be avoided.</p>
|
||
<p>In the second example, only users with <code>ENDPOINT_ADMIN</code> role are allowed to access
|
||
the actuator endpoints.</p>
|
||
|
||
<sample src="SpringBootActuators.java" />
|
||
</example>
|
||
|
||
<references>
|
||
<li>
|
||
Spring Boot documentation:
|
||
<a href="https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html">Actuators</a>.
|
||
</li>
|
||
<li>
|
||
<a href="https://www.veracode.com/blog/research/exploiting-spring-boot-actuators">Exploiting Spring Boot Actuators</a>
|
||
</li>
|
||
</references>
|
||
</qhelp>
|