id: springboot-heapdump

info:
  name: Detect Springboot Heapdump Actuator
  author: that_juan_ & dwisiswant0 & wdahlenb
  severity: critical
  description: Environment variables and HTTP requests can be found in the HPROF

requests:
  - method: GET
    path:
      - "{{BaseURL}}/heapdump"
      - "{{BaseURL}}/actuator/heapdump"
    matchers-condition: and
    matchers:
      - type: binary
        part: body
        binary:
          - "4a4156412050524f46494c45" # "JAVA PROFILE"
          - "4850524f46" # "HPROF"
          - "1f8b080000000000" # Gunzip magic byte
        condition: or
      - type: status
        status:
          - 200
      - type: word
        words:
          - "application/octet-stream"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
        condition: or
        part: header
      - type: dsl
        dsl:
          - "len(body) >= 100000"
          - "content_length >= 100000"
        condition: or
        part: header