Under the Radar: Exploring Spring Boot Actuator Misconfigurations

This report examines widespread misconfigurations of Spring Boot Actuator endpoints (heapdump, env, gateway) that can expose sensitive configuration and credentials and, when combined with vulnerable Spring Cloud Gateway versions, enable remote code execution (CVE-2022-22947). It documents prevalence metrics, observed scanning activity, step-by-step proof-of-concept abuse (including exfiltrating AWS instance metadata), and recommended mitigations such as disabling sensitive endpoints, enforcing authentication, and applying secure defaults.