Some vulnerabilities whisper instead of scream. They don't pop up with dramatic payloads, obvious SQL errors, or flashy admin bypasses. Sometimes, they hide behind a simple JSON response that looks harmless at first glance — until you read between the lines.

This is the story of how I discovered publicly accessible Spring Boot Actuator endpoints on a production system under the DTDC Responsible Disclosure Program… and how that small JSON output hinted at a much deeper risk.

And yes — everything you're about to read is fully redacted so no sensitive domains are exposed.

🔍 The Initial Test: A Quiet Endpoint With a Loud Message

I was scanning the application hosted at:

https://[REDACTED]/api/actuator/health

To most developers, the /health endpoint is normal. It usually returns a simple { "status": "UP" }. No drama. No risk.

But when Actuator isn't properly configured, /health becomes a window into the system's internal workings.

And that's exactly what happened here.

When I opened the endpoint, the server replied instantly with a detailed JSON object:

{
  "status": "UP",
  "components": {
    "db": {
      "status": "UP",
      "details": {
        "database": "MySQL",
        "result": 1,
        "validationQuery": "SELECT 1"
      }
    },
    "diskSpace": {
      "status": "UP",
      "details": {
        "total": 53464842240,
        "free": 28270936064,
        "threshold": 10485760
      }
    },
    "ping": { "status": "UP" }
  }
}

To the untrained eye, it looks like harmless system data.

To a hacker?

It's a map.

🧠 Why Exposed Actuator Endpoints Are Dangerous

Spring Boot Actuator is incredibly powerful. It's designed for internal monitoring, health checks, debugging, and system management.

But when exposed publicly?

It becomes a security misconfiguration with serious consequences.

Here's why:

🔹 1. Database Leak

The endpoint revealed:

  • The database type (MySQL)
  • Health check queries
  • Connection behavior

An attacker armed with DB metadata can craft targeted exploits.

🔹 2. Infrastructure Exposure

Disk space information exposes:

  • Total storage
  • Available space
  • Server load patterns

Useful for planning DoS or resource exhaustion attacks.

🔹 3. Potentially More Dangerous Endpoints

If /health is exposed, there's a chance endpoints like:

  • /env
  • /configprops