Critically Sensitive Spring Boot Endpoints Exposed

Summary

Spring Boot includes a number of additional features to help you monitor and manage your application when you push it to production. Hacker found that actuator endpoints containing potentially sensitive data (such as internal tokens and service data) were left public.

Semrush has a microservices architecture, there is an API gateway which routes to the server corresponding to the service in the internal network. Some Semrush services use spring boot with actuator endpoints enabled, some services left these endpoints publicly accessible. It was therefore possible to access it as follow: https://semrush.com/service-xyz/actuator/ . Some endpoints leaked sensitive internal data.