Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information

Summary

The dropwizard instance running on display.uber-adsystem.com is unsecured, meaning any unauthenticated user can view and use it's admin tools. These tools expose sensitive information on Uber production servers, including the current threads running, info on the CPU, and more server info that should not be exposed. More info on the information exposed through this panel can be seen on dropwizards docs here - https://metrics.dropwizard.io/3.1.0/manual/servlets/#adminservlet

Just a small admin toolset exposed here, leaking some server telemetry.

Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!