🔓 Improper Access Control in Spring Boot Actuator

How a Misconfigured Endpoint Exposed Internal Application Configuration

📌 Introduction

During a security assessment of a B2B customer portal, I discovered an Improper Access Control vulnerability (CWE-284) affecting internal management endpoints.

The issue allowed low-privileged users to access sensitive configuration data that should only be available to administrators.

🎯 Target Overview

The application is built using Spring Boot and exposes internal management endpoints via: /management/* These endpoints are typically used for: • Monitoring • Debugging • Configuration inspection

🔍 Step 1 — Verifying Role-Based Access Control

Before digging deeper, I verified whether RBAC (Role-Based Access Control) was properly implemented.

✅ Admin-Only Endpoint Test GET /api/customers/{id}/users

📊 Behavior

• Admin → 200 OK

• User → 401 Unauthorized

✔️ This confirmed that authorization exists and works correctly in some parts of the application.

🔐 Step 2 — JWT Analysis

Next, I analyzed the JWT tokens to understand permission differences.

👑 Admin Token • Multiple enabled modules • Extended privileges

👤 Regular User Token • Limited modules • Restricted access

🧠 This confirmed proper privilege separation at the token level.

⸻

💥 Step 3 — Discovering the Vulnerable Endpoint

While testing internal endpoints, I found: GET /management/configprops 📊 Results • Admin → 200 OK • User → 200 OK • Low-priv user → 200 OK

❗ All roles received identical sensitive data

🧪 Proof of Concept

GET /management/configprops HTTP/2 Host: <redacted> Cookie: access-token=<low-priv-user>

📦 Exposed Information

The response included: • Application configuration • Feature flags • Security-related settings • Internal API paths • Infrastructure metadata

⸻

⚠️ Impact Analysis

Even though the endpoint is read-only, the impact is serious.

⸻

🔓 Information Disclosure

Sensitive internal data is exposed to unauthorized users.

⸻

🧭 Attack Surface Expansion

Attackers can: • Map internal architecture • Discover hidden endpoints • Identify enabled modules

⸻

🚀 Attack Chaining

This can lead to: • Privilege escalation • Remote Code Execution (RCE) • Misconfiguration exploitation

⸻

❗ Security Violation

• Breaks Least Privilege Principle • Weakens Defense in Depth

⸻

🧠 Root Cause

Missing authorization checks on Spring Boot Actuator endpoints

Although RBAC exists, it was not consistently enforced across: /management/*

🛠️ Remediation

✅ 1. Restrict Management Endpoints /management/* → Should be accessible only by admin roles ✅ 2. Enforce Spring Security .antMatchers(“/management/**”).hasRole(“ADMIN”) ✅ 3. Limit Actuator Exposure management.endpoints.web.exposure.include=health,info

✅ 4. Disable Unnecessary Endpoints

Avoid exposing debugging endpoints in staging/production.

✅ 5. Isolate Management Interface • Bind to internal network only • Never expose publicly

⸻

🏁 Conclusion

This vulnerability highlights a critical lesson:

⚠️ Security must be consistent — not partial.

Even when RBAC is correctly implemented, a single overlooked endpoint can expose sensitive internal data.

⸻

💡 Key Takeaways

• Never expose Actuator endpoints publicly • Always enforce strict authorization • Validate access control across all endpoints • Treat configuration data as sensitive

⸻

🤝 Disclosure Timeline

• Vulnerability discovered and reported responsibly • Reviewed and validated by the security team • Successfully accepted and rewarded 🎯

⸻

✍️ Final Thoughts

Misconfigured internal endpoints are a common yet dangerous mistake.

Always remember:

🔐 “What is internal today can become public tomorrow.”