NewsSANS ISC DiarySME

    Java Spring Boot "heapdump" scans, (Mon, Jul 27th)

    Share
    Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application. Non-Java readers may be familiar with a similar concept, core dumps, which are produced by binaries to expose a memory image at the time the software crashes. "heapdumps" are the Java analog to "core-dumps". The heapdump often includes secrets used by the application to connect to backend systems. API keys, database passwords, and other sensitive data may be exposed in the heapdump.

    More on heapdump

    Other advisories

    Source: https://isc.sans.edu/diary/rss/33188

    ID