| name | spring-actuator-hardening |
| description | Authorized Spring Boot Actuator hardening: endpoint exposure, separate management port, Spring Security on /actuator, health details, and high-risk endpoints (env, heapdump, threaddump, loggers, shutdown, jolokia). Use when reviewing application.yml/properties, Spring Boot Actuator exposure, management.endpoints, or lab/prod apps you own — not for unauthorized scanning of third-party Actuators.
|
Spring Boot Actuator Hardening
Assess and harden Spring Boot Actuator for apps you own or are authorized to
test. Focus on exposure, auth, listen address/port, and data leaks — not abusing
third-party management APIs.
Scope And Authorization
- In scope: org-owned Spring Boot apps, staging/prod under engagement, labs/CTFs,
config/IaC review without live abuse of out-of-scope hosts.
- Out of scope: mass scanning
/actuator; heap/env dumps from foreign systems;
destructive shutdown/logger changes without change control.
- Prefer config review + non-destructive probes (
health, 401/403). Gate heapdump,
full env, and write endpoints behind approval. Redact secrets/PII/heap contents.
- Public unauth sensitive endpoints: isolate, rotate exposed secrets, audit logs.
- Defense only: prove reachability/auth gaps; K8s probes do not justify public
env/heapdump — split ports and exposure.
When To Use
- Reviewing
management.* in application.yml/.properties, Spring Cloud, or K8s probes
/actuator beyond internal mesh; exposure.include=*; sensitive endpoints without auth- Full health details public; management shares the public app port
- Boot 2.x/3.x hardening; post-incident “was Actuator open?”
Do not use as primary for: API JWT (api-auth-and-jwt-abuse), password vault
(secrets-management-hygiene), code baseline (code-quality-standards), edge TLS
(nginx-security-headers), SSRF to Actuator (ssrf-server-side-request-forgery),
K8s network/pod (kubernetes-network-policy, kubernetes-pod-security).
Workflow
1. Inventory
Boot version; base-path (default /actuator); exposure.include/exclude and
per-endpoint enabled; same app port vs management.server.port (+ address);
Spring Security matchers/roles; K8s probes, Service/Ingress, LB, gateway routes;
optional Jolokia, Cloud Gateway actuators, custom endpoints.
2. Authorized exposure checks
curl -sS -o /dev/null -w "%{http_code}\n" "https://app.example/actuator"
curl -sS "https://app.example/actuator/health"
curl -sS -o /dev/null -w "%{http_code}\n" "https://app.example/actuator/env"
curl -sS -o /dev/null -w "%{http_code}\n" "https://app.example/actuator/heapdump"
| Signal | Risk |
|---|
Unauth env / configprops / beans / mappings | Config and secret leak |
Unauth heapdump / threaddump | Memory/credential leak — critical |
Unauth write loggers / shutdown | Integrity / availability |
| Public Jolokia | Historical MBean/RCE class — disable or lock down |
| Full health details + DB URLs | Info leak; tighten show-details |
Private health/info only | Often acceptable with minimal info |
3. Hardening baseline
management:
server:
port: 8081
address: 127.0.0.1
endpoints:
web:
exposure:
include: health,info
exclude: env,heapdump,threaddump,logfile,shutdown,jolokia
endpoint:
health:
show-details: when_authorized
probes:
enabled: true
env:
enabled: false
shutdown:
enabled: false
- Expose only probe/ops needs; keep
metrics/prometheus private.
- Disable high-risk:
env, configprops, beans, mappings, heapdump,
threaddump, logfile, write loggers, shutdown, unused Jolokia.
- Separate management port/address; block at SG/mesh from the Internet.
- Authenticate non-public endpoints (e.g. role
ACTUATOR); no shared password in git.
- Health:
never or when_authorized; no open Actuator CORS for browsers.
4. Security, deploy, verify
http.securityMatcher("/actuator/**")
.authorizeHttpRequests(auth -> auth
.requestMatchers("/actuator/health", "/actuator/health/**").permitAll()
.requestMatchers("/actuator/**").hasRole("ACTUATOR"))
.httpBasic(Customizer.withDefaults());
Avoid permitAll on /actuator/**. Prefer private management port + allowlists.
Do not publish /actuator on public Ingress unless org accepts authenticated ops.
Reduce exposure; enforce Security; rotate secrets if env/heap was open; re-test
external vs internal; document exceptions; apply code-quality-standards and
secrets-management-hygiene.
Routing
| Situation | Primary | Helper |
|---|
| Actuator exposure, mgmt port, auth, health details | This skill | — |
| Management passwords / vault | secrets-management-hygiene | this skill |
| SecurityFilterChain / YAML changes | code-quality-standards | this skill |
| Edge TLS/headers blocking Actuator | nginx-security-headers | this skill |
| JWT/session on management login | api-auth-and-jwt-abuse | this skill |
| SSRF to internal Actuator | ssrf-server-side-request-forgery | this skill |
| K8s Service/probe placement | kubernetes-network-policy | this skill |
code-quality-standards: Security config, YAML, tests for Actuator auth.secrets-management-hygiene: ops credentials; no secrets in repo or /info.
Output Checklist
