Skip to content

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental #20006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jcogs33 merged 23 commits into from
Aug 26, 2025
Merged

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental #20006

Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
a39cb40
Java: copy out of experimental
Jul 9, 2025
0dbddbd
Java: remove experimental files
Jul 9, 2025
38260e7
Java: remove deprecation
Jul 10, 2025
fc930d9
Java: update tests for non-experimental directory
Jul 10, 2025
ed8da5e
Java: convert tests to inline expectations
Jul 14, 2025
b479f5c
Java: fix integration tests
Jul 14, 2025
1b90a30
Java: move code to .qll file
Jul 15, 2025
3823186
Java: split tests by versions
Jul 15, 2025
2bfc4b4
Java: fix test case for version 1.4
Jul 15, 2025
ae163a9
Java: add overlay annotations
Jul 16, 2025
0d2a422
Java: add related location to alert message
Jul 16, 2025
afa6610
Java: update qhelp
Jul 17, 2025
ea35fbb
Java: support version 3.x
Jul 17, 2025
7d5e939
Java: minor refactoring
Jul 17, 2025
ea529b0
Java: adjust metadata and alert msg
Jul 17, 2025
70d5150
Java: rename to align with 'java/spring-boot-exposed-actuators' query
Jul 17, 2025
8decc13
Java: add change note
Jul 17, 2025
685f68d
Java: support 'management.endpoints.web.expose' property
Jul 18, 2025
7250265
Java: consider all endpoints except for health and info as sensitive …
Jul 18, 2025
0dd33b2
Java: remove version debugging from alert message
Jul 19, 2025
c9692a6
Java: fix test failures cause by alert msg change
Jul 19, 2025
f0542dd
Java: add summary to change note
Aug 22, 2025
3675e4b
Merge branch 'main' into jcogs33/java/insecure-spring-actuator-config…
jcogs33 Aug 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Java: adjust metadata and alert msg
  • Loading branch information
Jami Cogswell authored and Jami Cogswell committed Jul 18, 2025
commit ea529b047b0223d025b0009fb95c944196a71da8
14 changes: 7 additions & 7 deletions .../ql/src/Security/CWE/CWE-200/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
/**
* @name Insecure Spring Boot Actuator Configuration
* @description Exposed Spring Boot Actuator through configuration files without declarative or procedural
* security enforcement leads to information leak or even remote code execution.
* @name Exposed Spring Boot actuators in configuration file
* @description Exposing Spring Boot actuators through configuration files may lead to information leak from
* the internal application, or even to remote code execution.
* @kind problem
* @problem.severity error
* @security-severity 6.5
* @precision high
* @id java/insecure-spring-actuator-config
* @id java/spring-boot-exposed-actuators-config
* @tags security
* experimental
* external/cwe/cwe-016
* external/cwe/cwe-200
*/

import java
Expand All @@ -21,5 +21,5 @@ where
// TODO: remove pom; for debugging versions
d = pom.getADependency()
select d,
"Insecure $@ of Spring Boot Actuator exposes sensitive endpoints (" +
"Insecure Spring Boot actuator $@ exposes sensitive endpoints (" +
pom.getParentElement().getVersionString() + ").", jpOption, "configuration"