---
title: "WEB-APP-006 Spring Boot Actuator Endpoints Fully Exposed"
canonical: https://openvapt.com/checks/WEB-APP-006.html
html: https://openvapt.com/checks/WEB-APP-006.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APP-006 Spring Boot Actuator Endpoints Fully Exposed

Checks Spring Boot application properties for management.endpoints.web.exposure.include=* and probes the local site for an open /actuator/env.

- Domain: Web Apps
- Severity: High
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-306, CWE-497
- OWASP Top 10 2021: A05:2021, A01:2021
- OWASP ASVS 4.0.3: 14.3.2, 4.3.2
- OWASP WSTG v4.2: WSTG-CONF-02, WSTG-CONF-05
- NIST SP 800-53 Rev. 5: CM-7, AC-3, SI-11

## Why It Matters

Actuator's env, configprops, heapdump and threaddump endpoints print environment variables, configuration (including credentials) and process memory. Exposing them all over HTTP without authentication is one of the most common Java application leaks.

## How It Detects

Reads application.properties, application.yml and their -prod variants in the project folders for exposure.include set to * (or a list containing env, heapdump or configprops) with no management.server.port moving them off the public port. Also requests /actuator/env on each local site and fails on a JSON reply containing propertySources.

## How to Fix

Set management.endpoints.web.exposure.include=health,info (and exclude env,heapdump,configprops), move management.server.port to a port that is not published, and require authentication for every actuator endpoint with Spring Security.

## How to Verify

```
curl -s -o /dev/null -w '%{http_code}' https://<site>/actuator/env  prints 401, 403 or 404.
```

## Learn the Theory

- [A6 Application Framework and CMS Configuration](https://openvapt.com/academy/a6.md)

## References

- [Spring Boot documentation, Actuator endpoints](https://docs.spring.io/spring-boot/reference/actuator/endpoints.html)
- [Spring Boot documentation, Securing HTTP endpoints](https://docs.spring.io/spring-boot/reference/actuator/endpoints.html#actuator.endpoints.security)
- [OWASP WSTG-CONF-02, Test Application Platform Configuration](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/02-Test_Application_Platform_Configuration/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go

Run it: `openvapt scan --only WEB-APP-006`. Read it offline: `openvapt explain WEB-APP-006`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APP-006.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.