nuclei-templates/security-misconfiguration/springboot-detect.yaml

id: springboot-actuators

info:
  name: Detect the exposure of Springboot Actuators
  author: that_juan_ & dwisiswant0
  severity: medium

requests:
  - method: GET
    path:
      - "{{BaseURL}}/actuator"
      - "{{BaseURL}}/actuator/auditevents"
      - "{{BaseURL}}/actuator/auditLog"
      - "{{BaseURL}}/actuator/beans"
      - "{{BaseURL}}/actuator/caches"
      - "{{BaseURL}}/actuator/conditions"
      - "{{BaseURL}}/actuator/configprops"
      - "{{BaseURL}}/actuator/configurationMetadata"
      - "{{BaseURL}}/actuator/dump"
      - "{{BaseURL}}/actuator/env"
      - "{{BaseURL}}/actuator/events"
      - "{{BaseURL}}/actuator/exportRegisteredServices"
      - "{{BaseURL}}/actuator/features"
      - "{{BaseURL}}/actuator/flyway"
      - "{{BaseURL}}/actuator/health"
      - "{{BaseURL}}/actuator/healthcheck"
      - "{{BaseURL}}/actuator/heapdump"
      - "{{BaseURL}}/actuator/httptrace"
      - "{{BaseURL}}/actuator/hystrix.stream"
      - "{{BaseURL}}/actuator/info"
      - "{{BaseURL}}/actuator/integrationgraph"
      - "{{BaseURL}}/actuator/jolokia"
      - "{{BaseURL}}/actuator/liquibase"
      - "{{BaseURL}}/actuator/logfile"
      - "{{BaseURL}}/actuator/loggers"
      - "{{BaseURL}}/actuator/loggingConfig"
      - "{{BaseURL}}/actuator/management"
      - "{{BaseURL}}/actuator/mappings"
      - "{{BaseURL}}/actuator/metrics"
      - "{{BaseURL}}/actuator/refresh"
      - "{{BaseURL}}/actuator/registeredServices"
      - "{{BaseURL}}/actuator/releaseAttributes"
      - "{{BaseURL}}/actuator/resolveAttributes"
      - "{{BaseURL}}/actuator/scheduledtasks"
      - "{{BaseURL}}/actuator/sessions"
      - "{{BaseURL}}/actuator/shutdown"
      - "{{BaseURL}}/actuator/springWebflow"
      - "{{BaseURL}}/actuator/sso"
      - "{{BaseURL}}/actuator/ssoSessions"
      - "{{BaseURL}}/actuator/statistics"
      - "{{BaseURL}}/actuator/status"
      - "{{BaseURL}}/actuator/threaddump"
      - "{{BaseURL}}/actuator/trace"
      - "{{BaseURL}}/auditevents"
      - "{{BaseURL}}/autoconfig"
      - "{{BaseURL}}/beans"
      - "{{BaseURL}}/cloudfoundryapplication"
      - "{{BaseURL}}/configprops"
      - "{{BaseURL}}/dump"
      - "{{BaseURL}}/env"
      - "{{BaseURL}}/health"
      - "{{BaseURL}}/heapdump"
      - "{{BaseURL}}/hystrix.stream"
      - "{{BaseURL}}/info"
      - "{{BaseURL}}/jolokia"
      - "{{BaseURL}}/jolokia/list"
      - "{{BaseURL}}:8090/jolokia"
      - "{{BaseURL}}:8090/jolokia/list"
      - "{{BaseURL}}/loggers"
      - "{{BaseURL}}/management"
      - "{{BaseURL}}/mappings"
      - "{{BaseURL}}/metrics"
      - "{{BaseURL}}/threaddump"
      - "{{BaseURL}}/trace"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "method"
          - "spring"
          - "TYPE"
          - "system"
          - "database"
          - "cron"
          - "reloadByURL"
          - "JMXConfigurator"
          - "JMImplementation"
          - "EnvironmentManager"
        condition: or
      - type: status
        status:
          - 200
      - type: word
        words:
          - "X-Application-Context"
          - "application/json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "hprof"
        condition: or
        part: header