The endpoint that prints your config
In one week 168 requests went hunting for the built-in management endpoints a widely used Java framework ships for health checks and metrics, spread across 32 different spellings of the path. 40 of them targeted the endpoint that lists the application's configuration properties. Three did not request it directly: they placed a traversal sequence in front of the path, so a proxy rule blocking the endpoint by name never matches while the application behind still receives the request. None of this is an exploit. Recent framework versions expose only health and info over HTTP by default and mask values that look like credentials, so what the scan is really testing is whether yours was configured to expose more than that, without authentication in front of it.
A hundred and sixty-eight requests asked this server to print its own configuration.
A widely used Java framework ships built-in endpoints for health checks and metrics. One of them lists every configuration property the application was started with.
In one week, a hundred and sixty-eight requests went hunting for those endpoints, in thirty-two different spellings of the path.
Forty asked for the configuration one specifically. Five went further and wanted a heap dump, which is a copy of the running application’s memory.
Three did not ask directly. They put a traversal sequence in front of the path, so a proxy rule that blocks the endpoint by name never matches.
None of this is an exploit. Recent versions expose only health and info by default, and mask anything that looks like a credential.
Check whether your management endpoints answer from outside your network.
#linux#security#selfhosted#devops#sysadmin
❯ Check whether your management endpoints answer from outside.