Stripo Inc · Report #1019367
Memory Dump and Env Disclosure via Spring Boot Actuator
Validstatus
mediumseverity
27upvotes
2 Mar 2021disclosed
Summary
Memory Dump and Env Disclosure via Spring Boot Actuator
Spring boot actuator files/endpoints can be accessed via path like stripo.email/██████/actuator/*, including a 110 MB heapdump file, which expose source code, private keys and some internal data!
The maximum severity of this asset is medium, so neither I nor the triage team have been able to set severity as critical.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.