Java Spring Boot "heapdump" scans, (Mon, Jul 27th)

Spring Boot exposes the endpoint /actuator/heapdump to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application. Non-Java readers may be familiar with a similar concept, core dumps, which are produced by binaries to expose a memory image at the time the software crashes. heapdumps are the Java analog to core-dumps . The heapdump often includes secrets used by the application to connect to backend systems. API keys, database passwords, and other sensitive data may be exposed in the heapdump. The requests we are seeing use a slightly different URL: /admin-api/actuator/heapdump . I am not sure if the /admin-api/ prefix is associated with a particular application, but it is a reasonable configuration and may be used by multiple applications. The full request we are seeing: GET /admin-api/actuator/heapdump HTTP/1.1 Host: 68.77.136.94 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Authorization: Basic YWRtaW46YWRtaW4= The base64-encoded authorization string decodes to admin:admin, a typical default username and password. The location of the management endpoints is typically configured in your application.yml file with: management.endpoints.web.base-path=/admin-api/actuator Since this is used by Spring Boot, you should be able to restrict access more effectively with Spring Security. But the attacker obviously assumes that authentication is configured and just relies on a weak password. -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter | (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.