Skip to content

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental #20006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jcogs33 merged 23 commits into from
Aug 26, 2025
Merged

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental #20006

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
a39cb40
Java: copy out of experimental
Jul 9, 2025
0dbddbd
Java: remove experimental files
Jul 9, 2025
38260e7
Java: remove deprecation
Jul 10, 2025
fc930d9
Java: update tests for non-experimental directory
Jul 10, 2025
ed8da5e
Java: convert tests to inline expectations
Jul 14, 2025
b479f5c
Java: fix integration tests
Jul 14, 2025
1b90a30
Java: move code to .qll file
Jul 15, 2025
3823186
Java: split tests by versions
Jul 15, 2025
2bfc4b4
Java: fix test case for version 1.4
Jul 15, 2025
ae163a9
Java: add overlay annotations
Jul 16, 2025
0d2a422
Java: add related location to alert message
Jul 16, 2025
afa6610
Java: update qhelp
Jul 17, 2025
ea35fbb
Java: support version 3.x
Jul 17, 2025
7d5e939
Java: minor refactoring
Jul 17, 2025
ea529b0
Java: adjust metadata and alert msg
Jul 17, 2025
70d5150
Java: rename to align with 'java/spring-boot-exposed-actuators' query
Jul 17, 2025
8decc13
Java: add change note
Jul 17, 2025
685f68d
Java: support 'management.endpoints.web.expose' property
Jul 18, 2025
7250265
Java: consider all endpoints except for health and info as sensitive …
Jul 18, 2025
0dd33b2
Java: remove version debugging from alert message
Jul 19, 2025
c9692a6
Java: fix test failures cause by alert msg change
Jul 19, 2025
f0542dd
Java: add summary to change note
Aug 22, 2025
3675e4b
Merge branch 'main' into jcogs33/java/insecure-spring-actuator-config…
jcogs33 Aug 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Java: support version 3.x
  • Loading branch information
Jami Cogswell authored and Jami Cogswell committed Jul 18, 2025
commit ea35fbbe3b0183ca22e94f5a7b4c0d96513c9cd4
4 changes: 2 additions & 2 deletions java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationPropertie
me.hasSecurityDisabled() and me.getFile() = apFile and me = apOption.asSome()
)
or
springBootVersion.matches("2.%") and //version 2.x
springBootVersion.matches(["2.%", "3.%"]) and //version 2.x and 3.x
exists(ManagementEndPointInclude mi |
mi.getFile() = apFile and
mi = apOption.asSome() and
Expand All @@ -121,7 +121,7 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationPropertie
.matches([
"%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%",
"%env%", "%beans%", "%sessions%"
]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
]) // confidential endpoints to check although all endpoints apart from '/health' are considered sensitive by Spring
)
)
)
Expand Down
9 changes: 5 additions & 4 deletions ...y/CWE-200/semmle/tests/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints (1.2.6.RELEASE). | file://:0:0:0:0 | (none) | configuration |
| Version1.4-/bad/false/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints (1.2.6.RELEASE). | Version1.4-/bad/false/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
| Version1.5/bad/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints (1.5.6.RELEASE). | Version1.5/bad/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
| Version2+/bad/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints (2.2.6.RELEASE). | Version2+/bad/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |
| Version1.0.x-1.4.x/bad/default/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints (1.2.6.RELEASE). | file://:0:0:0:0 | (none) | configuration |
| Version1.0.x-1.4.x/bad/false/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints (1.2.6.RELEASE). | Version1.0.x-1.4.x/bad/false/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
| Version1.5.x/bad/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints (1.5.6.RELEASE). | Version1.5.x/bad/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
| Version2.x/bad/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints (2.2.6.RELEASE). | Version2.x/bad/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |
| Version3.x/bad/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints (3.3.5). | Version3.x/bad/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |
0 ...on1.4-/bad/default/application.properties → ...-1.4.x/bad/default/application.properties
View file
Open in desktop
File renamed without changes.
0 ...torConfig/Version1.4-/bad/default/pom.xml → ...ig/Version1.0.x-1.4.x/bad/default/pom.xml
View file
Open in desktop
File renamed without changes.
0 ...sion1.4-/bad/false/application.properties → ....x-1.4.x/bad/false/application.properties
View file
Open in desktop
File renamed without changes.
0 ...uatorConfig/Version1.4-/bad/false/pom.xml → ...nfig/Version1.0.x-1.4.x/bad/false/pom.xml
View file
Open in desktop
File renamed without changes.
0 ...g/Version1.4-/good/application.properties → ...on1.0.x-1.4.x/good/application.properties
View file
Open in desktop
File renamed without changes.
0 ...ngActuatorConfig/Version1.4-/good/pom.xml → ...torConfig/Version1.0.x-1.4.x/good/pom.xml
View file
Open in desktop
File renamed without changes.
0 ...fig/Version1.5/bad/application.properties → ...g/Version1.5.x/bad/application.properties
View file
Open in desktop
File renamed without changes.
0 ...ringActuatorConfig/Version1.5/bad/pom.xml → ...ngActuatorConfig/Version1.5.x/bad/pom.xml
View file
Open in desktop
File renamed without changes.
0 ...ig/Version1.5/good/application.properties → .../Version1.5.x/good/application.properties
View file
Open in desktop
File renamed without changes.
0 ...ingActuatorConfig/Version1.5/good/pom.xml → ...gActuatorConfig/Version1.5.x/good/pom.xml
View file
Open in desktop
File renamed without changes.
14 changes: 0 additions & 14 deletions ...curity/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version2+/application.properties
View file
Open in desktop

This file was deleted.

7 changes: 0 additions & 7 deletions ...ty/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version2+/bad/application.properties
View file
Open in desktop

This file was deleted.

2 changes: 0 additions & 2 deletions ...y/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version2+/good/application.properties
View file
Open in desktop

This file was deleted.

2 changes: 2 additions & 0 deletions ...y/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version2.x/bad/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
management.endpoints.web.exposure.include=*
0 ...pringActuatorConfig/Version2+/bad/pom.xml → ...ringActuatorConfig/Version2.x/bad/pom.xml
View file
Open in desktop
File renamed without changes.
2 changes: 2 additions & 0 deletions .../CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version2.x/good/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# safe configuration (spring boot 2+): exposes health and info only by default
management.endpoints.web.exposure.include=info,health
0 ...ringActuatorConfig/Version2+/good/pom.xml → ...ingActuatorConfig/Version2.x/good/pom.xml
View file
Open in desktop
File renamed without changes.
2 changes: 2 additions & 0 deletions ...y/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version3.x/bad/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# vulnerable configuration (spring boot 3+): exposes health only by default, here overridden to expose everything
management.endpoints.web.exposure.include=*
47 changes: 47 additions & 0 deletions ...y-tests/security/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version3.x/bad/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>spring-boot-actuator-app</groupId>
<artifactId>spring-boot-actuator-app</artifactId>
<version>1.0-SNAPSHOT</version>

<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
</properties>

<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.3.5</version>
<relativePath/>
</parent>

<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency> <!-- $ Alert -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
</dependency>
<!-- dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-test</artifactId>
</dependency>
</dependencies>

</project>
2 changes: 2 additions & 0 deletions .../CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version3.x/good/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# safe configuration (spring boot 3+): exposes health only by default.
management.endpoints.web.exposure.include=health
47 changes: 47 additions & 0 deletions ...-tests/security/CWE-200/semmle/tests/InsecureSpringActuatorConfig/Version3.x/good/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>spring-boot-actuator-app</groupId>
<artifactId>spring-boot-actuator-app</artifactId>
<version>1.0-SNAPSHOT</version>

<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
</properties>

<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.3.5</version>
<relativePath/>
</parent>

<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-test</artifactId>
</dependency>
</dependencies>

</project>