---
description: Spring Boot Exploits
---

# Spring

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## CVE-2024-38819

{% embed url="https://github.com/masa42/CVE-2024-38819-POC" %}

## SSTI

{% embed url="https://modzero.com/en/blog/spring_boot_ssti/" %}

## Spring Boot Actuator

{% embed url="https://www.wiz.io/blog/spring-boot-actuator-misconfigurations" %}

`heapdump` endpoint is designed to capture the current state of the Java heap, making it a valuable tool for diagnosing memory issues. However, if credentials such as passwords, tokens, cloud keys, or other secrets are loaded into the memory of a Java application’s JVM during its runtime, these might be included in the heap dump.

Up until version 1.5 (released in 2017), the `/heapdump` endpoint was configured as publicly exposed and accessible without authentication by default.&#x20;

```
curl 'http://localhost:8080/actuator/heapdump' -O 
```

Look for secrets:

<pre><code><strong># AWS Access and Secret Keys
</strong><strong>strings heapdump | grep -B 2 -A 2 "AKIA"
</strong>
# JWT Tokens
strings heapdump | grep -B 2 -A 2 "eyJ"

# Cookies and Session Tokens
strings heapdump | grep -E "^Host:\s+\S+$" -C 10
</code></pre>

### CVE-2022-22947 - RCE

* SSRF

{% content-ref url="../web-attacks/ssrf" %}
[ssrf](../web-attacks/ssrf)
{% endcontent-ref %}

Access `/gateway/routes` or `/actuator/gateway/routes`

&#x20;If the application responds with a 200 status code and contains fields like `predicate` or `route_id` in JSON format, it indicates that the endpoint is enabled and exposed to the internet.

&#x20;Craft a malicious route that forwards requests to the AWS Instance Metadata Service (IMDS) accessible at `http://169.254.169.254`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F21R1Fu7zdrUEaRlm6nQs%2Fimage.png?alt=media&#x26;token=48925235-efef-4624-8f78-3a8588718981" alt=""><figcaption></figcaption></figure>

Refresh to update the gateway's routing configuration

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FbjXnJTvL8914LqaakfGq%2Fimage.png?alt=media&#x26;token=76ebdc88-1df7-4002-bd30-d5bf5c62c534" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2Fd0nX38VO1Z9OklgRUAew%2Fimage.png?alt=media&#x26;token=95aa3e4e-17f5-4bcd-9e2d-c1278fad11f7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FbSA7naO5ESiejwkLyc2S%2Fimage.png?alt=media&#x26;token=be27fd01-d439-44cc-8838-e9246d3eb6d4" alt=""><figcaption></figcaption></figure>

{% content-ref url="../../cloud/ssrf-rce" %}
[ssrf-rce](../../cloud/ssrf-rce)
{% endcontent-ref %}

* RCE

POST request to `/gateway/routes/new_route_name` to create a new route. The arguments sent in the body of this request are vulnerable to code injection.

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FnZBQLqQzX4owOhmRc2LO%2Fimage.png?alt=media&#x26;token=10984c08-f4be-4825-a5ee-1306bbc30e0b" alt=""><figcaption></figcaption></figure>

Refresh to add teh new route

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FyzHZJDsNFnCeRlh2SaDc%2Fimage.png?alt=media&#x26;token=a5123a1f-fb41-47e6-b7cd-6729c54c2f38" alt=""><figcaption></figcaption></figure>

### Env endpoint

`/actuator/env` endpoint is specifically designed to expose details about the application’s runtime environment. When accessing the env endpoint, it returns a structured JSON response displaying configuration properties and environment variables used by the application.&#x20;

Up until version 1.5, this endpoint was publicly exposed without authentication by default.

### Other endpoints

Other actuator endpoints such as `/metrics`, `/threaddump` and `/scheduledtasks` can also expose sensitive data that could be valuable for attackers. To safeguard your application, it is recommended to limit access to the actuator’s endpoints and ensure that endpoint are not unnecessarily publicly exposed without authentication.&#x20;

The following example shows the `http.client.requests` metric exposing sensitive details including an internal IP address, a potentially sensitive "session" endpoint, and request patterns.

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FwuKgjkQNPrD3BYeNkGqj%2Fimage.png?alt=media&#x26;token=4a373e33-e573-4aeb-a224-f54994cb97df" alt=""><figcaption></figcaption></figure>

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)
