THE article by Johannes Ullrich discusses Java Spring Boot's '/actuator/heapdump' endpoint used to gather application debug information, noting its potential to expose sensitive data such as API keys and database passwords. The author observes unusual requests targeting a variant URL '/admin-api/actuator/heapdump', with a base64-encoded authorization header suggesting default credentials ('admin:admin'). It highlights the importance of securing such endpoints with proper authentication like Spring Security to mitigate risks.
Spring Boot Heapdump Endpoint Exposes API Keys via Default Creds
CyberSIXT Evidence Panel
Source marked as original reporting
Article by CyberSIXT