Spring Boot Heapdump Endpoint Exposes API Keys via Default Creds

The article by Johannes Ullrich discusses Java Spring Boot's '/actuator/heapdump' endpoint used to gather application debug information, noting its potential to expose sensitive data such as API keys and database passwords. The author observes unusual requests targeting a variant URL '/admin-api/actuator/heapdump', with a base64-encoded authorization header suggesting default credentials ('admin:admin'). It highlights the importance of securing such endpoints with proper authentication like Spring Security to mitigate risks.