Closed gingeleski closed 3 years ago
Consider adding checks for Spring Boot Actuator, which if openly accessible in production can be leveraged to run trace, dump memory, manipulate environment variables, etc. [1][2][3]
Looks like patterns might be added here to directories.dat.
/actuator /actuator/auditevents /actuator/autoconfig /actuator/beans /actuator/caches /actuator/conditions /actuator/configprops /actuator/env /actuator/flyway /actuator/health /actuator/httptrace /actuator/info /actuator/integrationgraph /actuator/loggers /actuator/liquibase /actuator/metrics /actuator/mappings /actuator/scheduledtasks /actuator/sessions /actuator/shutdown /actuator/threaddump /actuator/heapdump /actuator/jolokia /actuator/logfile /actuator/prometheus
PLease create pull request
Done, thank you.
Consider adding checks for Spring Boot Actuator, which if openly accessible in production can be leveraged to run trace, dump memory, manipulate environment variables, etc. [1][2][3]
Looks like patterns might be added here to directories.dat.