Perils of Spring Boot Actuators Misconfiguration
By: Deepak Sulakhe
Tags: Spring Boot, Infosec, Security Misconfiguration, Spring, Java

Spring framework provides wonderful features called “actuators” to help engineers monitor and manage web applications.

The actuators are intended to be used for auditing, health and metrics gathering. These are excellent features, so you might be wondering what’s the danger here? Hold on a second! While these endpoints are very useful in a non-production environment, if they are enabled on production environment and are misconfigured, they can also open a back door to your server. For example, your application can accidentally reveal credentials in active memory through a heap dump, allow evil actors to modify the application environment properties, or in the worst case evil actors can completely bring down your application.

It’s very important for developers to know about the security implications of using actuator endpoints, especially if an application is accessible via the internet.

Apart from /health and /info, all actuator endpoints are risky to open to end users because they can expose application dumps, logs, configuration data and controls. The actuator endpoints have security implications and SHOULD NEVER EVER be exposed in production environment.

Here is a list of the data and and functionalities which may be exposed by common spring boot actuator end-points:

/heapdump : displays heap dumps which may have sensitive data like your database credentials

/threadump : displays thread dumps including stack trace

/trace : displays last several HTTP messages which could include session identifiers

/logfile : outputs contents of application logs, which may contain debugging or other non-public details.

/shutdown : shuts the application down

/mappings : shows all the MVC controller mappings

/env : provides access to the configuration environment

/restart : restarts the application

There are many more. Please refer the full list of endpoints in the Spring docs.

From security point of view, in production environments it is recommended to disable all spring actuator endpoints and expose only non harmful endpoints like /health only if required for purposes like monitoring application health.

Beware, in Spring 1.x all actuator endpoints are accessible without any authentication.

In Spring 2.x, all endpoints apart from /health and /info are considered sensitive and secured by default. Application developers should not disable the security config and expose other end points in production environment.

To disable all endpoints, in application.properties , set

management.endpoints.enabled-by-default = false

After disabling, only enable needed endpoints by setting the respective config, e.g., to enable health endpoint, set

management.endpoint.health.enabled = true

If there is a genuine requirement to enable metrics collection and you need to enable spring boot actuators endpoints for that purpose, then take care to secure actuator endpoints in the same way you would secure any other sensitive endpoint. If you are using spring-security, make sure actuator endpoints are also secured. If you wish to configure custom rules like, only allow users with a certain role to access them, spring boot provides some convenient RequestMatcher object that can be used in combination with spring security.

P.S.: Securing actuator endpoints should be done only if these endpoints are really needed in production environment. If actuator endpoints are not needed then recommendation is to disable them all.

Summary

Spring boot actuator endpoints provides really cool features for monitoring applications, but also introduce security concerns. Hence one should not enable these endpoints in production by default. But if you really need to enable actuators, then protect these endpoints in same way as you treat any other endpoints with sensitive data. Access permissions should be the minimum necessary.

Thank you for reading.