id: springboot-heapdump

info:
  name: Spring Boot Actuator - Heap Dump Detection
  author: that_juan_,dwisiswant0,wdahlenb
  severity: critical
  description: A Spring Boot Actuator heap dump was detected. A heap dump is a snapshot of JVM memory, which could expose environment variables and HTTP requests.
  reference:
    - https://github.com/pyn3rd/Spring-Boot-Vulnerability
  tags: springboot,exposure

requests:
  - method: GET
    path:
      - "{{BaseURL}}/heapdump"
      - "{{BaseURL}}/actuator/heapdump"

    stop-at-first-match: true
    max-size: 2097152 # 2MB - Max Size to read from server response
    matchers-condition: and
    matchers:

      - type: binary
        part: body
        binary:
          - "4a4156412050524f46494c45" # "JAVA PROFILE"
          - "4850524f46" # "HPROF"
          - "1f8b080000000000" # Gunzip magic byte
        condition: or

      - type: status
        status:
          - 200

# Enhanced by mp on 2022/05/20