CodeQL query to detect open Spring Boot actuator endpoints by ggolawski · Pull Request #2901 · github/codeql

ggolawski · 2020-02-23T19:23:13Z

This PR adds a query to detect open Spring Boot actuator endpoints. It flags custom Spring Security configurations that allow unauthenticated access to an actuator endpoint, like this one:

@Configuration(proxyBeanMethods = false)
public class ActuatorSecurity extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    // BAD: Unauthenticated access to Spring Boot actuator endpoints is allowed
    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests((requests) ->
        requests.anyRequest().permitAll());
  }
}

Unauthenticated Spring Boot actuators may leak sensitive information or even lead to remote code execution: https://www.veracode.com/blog/research/exploiting-spring-boot-actuators, https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database.

Test cases are also added, but without the .expected file.

aschackmull · 2020-03-31T13:03:49Z

Apologies for the delay in reviewing this PR. We think this is a useful contribution but it will likely require a number of changes before we can accept it into our standard query set.

In order to streamline our review process going forward, we are now accepting experimental contributions. If you'd like to move this query into the experimental directory as per those guidelines, then we'll be able to proceed more quickly with this PR.

Otherwise the query looks mostly good, although I'd like to see at least one result on some project to verify the applicability of the query. As for the documentation, it is claimed that this can "lead to information disclosure or even to remote code execution" - it would be nice to include some references or explanation to document how this happens.

aschackmull · 2020-04-02T08:30:53Z

We tried running this across all of lgtm.com https://lgtm.com/query/483327956475899158/ and got zero results.

ggolawski · 2020-04-02T22:45:27Z

I've moved the query to experimental and added the reference to an article that describes how to exploit this to get RCE (https://www.veracode.com/blog/research/exploiting-spring-boot-actuators).

When you search for EndpointRequest.toAnyEndpoint() in GitHub and exclude test classes, you'll get 2K results (https://github.com/search?l=Java&p=36&q=EndpointRequest.toAnyEndpoint%28%29+-filename%3A%2ATests.java&type=Code), but indeed mainly in demos and samples. I was pretty sure that this kind of misconfiguration is much more common. Anyway I think that I could find some 'real' projects (I'm not sure about this, so please verify):

These projects are not available on LGTM, but the actuators are exposed in the same as in my test code, so my query should detect these issues.

aschackmull · 2020-04-03T07:29:06Z

Thank you very much for those references. This definitely helps our evaluation.

java/ql/src/experimental/Security/CWE/CWE-016/SpringBootActuators.qll

…ors.qll Co-Authored-By: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

ggolawski · 2020-04-03T19:48:45Z

Thanks for the suggestion. I've committed the change.
I've also added stubs, qlpack.yml and expected results, so the test for the query is runnable via codeql test run.

Please verify if everything is fine, especially qlpack.yml files - I had to add them in src/experimental and test/experimental.

ggolawski · 2020-04-27T21:28:52Z

I've removed qlpack.yml files - I've realized that they're not needed.

aschackmull

Thanks a lot for adding the working test. This looks ready to merge.

pwntester · 2020-05-15T11:16:59Z

java/ql/src/experimental/Security/CWE/CWE-016/SpringBootActuators.qll

+  predicate permitsSpringBootActuators() {
+    exists(AuthorizeRequestsCall authorizeRequestsCall |
+      // .requestMatcher(EndpointRequest).authorizeRequests([...]).[...]
+      authorizeRequestsCall.getQualifier() instanceof RequestMatcherCall
+      or
+      // .requestMatchers(matcher -> EndpointRequest).authorizeRequests([...]).[...]
+      authorizeRequestsCall.getQualifier() instanceof RequestMatchersCall
+      or
+      // http.authorizeRequests([...]).[...]
+      authorizeRequestsCall.getQualifier() instanceof VarAccess


@ggolawski this clause seems to be causing many FPs where there are no evidences that Spring Actuators are being used.

See results here https://lgtm.com/query/4456298315122374638/

If EndpointRequest is not used, we need a different way to know that Actuators are indeed enabled.

Having said that, those results may be of interest for a different query in the line of https://vulncat.fortify.com/en/weakness?q=spring%20security%20misconfiguration

Also, for lines 91 and 93 there are some FPs in the form of:

http.authorizeRequests().requestMatchers(EndpointRequest.to("info", "health")).permitAll();

which could be solved by checking that TypeEndpointRequestMatcher matches only EndpointRequestMatcher returned by toAnyEndpoint() or by to() if arguments contains an edpoint other than health and info which are of no interest and public

Thanks for spotting this. My intention was to raise the flag only if EndpointRequest.toAnyEndpoint() is being used. I'll check what's wrong and correct this query.

ggolawski · 2020-05-18T21:13:19Z

@pwntester I fixed these FPs in #3506. Please check it.

pwntester · 2020-05-19T09:18:22Z

Awesome, thanks!

iamvolvo · 2025-01-09T15:11:54Z

Hi there, have you considered promoting this out of experimental?

Recent news suggest this is something companies sometimes get wrong and should be concerned with. See:

CodeQL query to detect open Spring Boot actuator endpoints

fda4ab1

ggolawski requested review from a team and felicitymay as code owners February 23, 2020 19:23

ggolawski mentioned this pull request Feb 23, 2020

CodeQL query to detect open Spring Boot actuator endpoints github/securitylab#42

Closed

1 task

aschackmull added the Java label Mar 6, 2020

ggolawski added 3 commits April 2, 2020 22:06

Merge branch 'master' into java-spring-boot-actuators

cffe89f

Move to experimental

f05b2af

Fix

6ca963a

aschackmull reviewed Apr 3, 2020

View reviewed changes

java/ql/src/experimental/Security/CWE/CWE-016/SpringBootActuators.qll Outdated Show resolved Hide resolved

ggolawski and others added 2 commits April 3, 2020 21:36

Update java/ql/src/experimental/Security/CWE/CWE-016/SpringBootActuat…

79d7ea3

…ors.qll Co-Authored-By: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

Make the test runnable via codeql test run

1d8da90

Remove qlpack.yml as these are not needed

639aa82

aschackmull approved these changes Apr 29, 2020

View reviewed changes

aschackmull merged commit 29a5ea1 into github:master Apr 29, 2020

ggolawski deleted the java-spring-boot-actuators branch April 30, 2020 18:25

pwntester reviewed May 15, 2020

View reviewed changes

ggolawski mentioned this pull request May 18, 2020

Fixes FPs in SpringBootActuators query #3506

Merged

jcogs33 mentioned this pull request Feb 25, 2025

Java: Promote Spring Boot Actuators query from experimental #18793

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CodeQL query to detect open Spring Boot actuator endpoints#2901

CodeQL query to detect open Spring Boot actuator endpoints#2901
aschackmull merged 7 commits intogithub:masterfrom
ggolawski:java-spring-boot-actuators

ggolawski commented Feb 23, 2020

Uh oh!

aschackmull commented Mar 31, 2020

Uh oh!

aschackmull commented Apr 2, 2020

Uh oh!

ggolawski commented Apr 2, 2020

Uh oh!

aschackmull commented Apr 3, 2020

Uh oh!

Uh oh!

ggolawski commented Apr 3, 2020

Uh oh!

ggolawski commented Apr 27, 2020

Uh oh!

aschackmull left a comment

Uh oh!

pwntester May 15, 2020 •

edited

Loading

Uh oh!

ggolawski May 18, 2020

Uh oh!

ggolawski commented May 18, 2020

Uh oh!

pwntester commented May 19, 2020

Uh oh!

iamvolvo commented Jan 9, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

ggolawski commented Feb 23, 2020

Uh oh!

aschackmull commented Mar 31, 2020

Uh oh!

aschackmull commented Apr 2, 2020

Uh oh!

ggolawski commented Apr 2, 2020

Uh oh!

aschackmull commented Apr 3, 2020

Uh oh!

Uh oh!

ggolawski commented Apr 3, 2020

Uh oh!

ggolawski commented Apr 27, 2020

Uh oh!

aschackmull left a comment

Choose a reason for hiding this comment

Uh oh!

pwntester May 15, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ggolawski May 18, 2020

Choose a reason for hiding this comment

Uh oh!

ggolawski commented May 18, 2020

Uh oh!

pwntester commented May 19, 2020

Uh oh!

iamvolvo commented Jan 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pwntester May 15, 2020 •

edited

Loading

iamvolvo commented Jan 9, 2025 •

edited

Loading