The Spring Boot framework exposes an actuator endpoint "/actuator/heapdump" that returns a binary heap dump of the running Java application. This heap dump can include sensitive information such as API keys, database passwords, and other secrets used by the application. Attackers have been observed scanning for this endpoint, sometimes using default or weak credentials (e.g., "admin:admin") to gain access. The endpoint path can be customized via configuration (e.g., management.endpoints.web.base-path), but if authentication is weak or absent, sensitive data can be exposed. The vulnerability arises from the exposure of debug information that should be protected by strong authentication and authorization controls.

If an attacker gains unauthorized access to the "/actuator/heapdump" endpoint, they can download a heap dump file containing sensitive application secrets such as API keys and database passwords. This exposure can lead to further compromise of backend systems and data breaches. The impact depends on the strength of authentication protecting the endpoint and the sensitivity of the information contained in the heap dump.

Restrict access to the "/actuator/heapdump" endpoint using strong authentication and authorization mechanisms, such as Spring Security. Avoid using default or weak credentials. Consider disabling the heapdump endpoint in production environments if not needed. Review and configure the management endpoints base path carefully to reduce exposure. Monitor for unauthorized access attempts and rotate any secrets that may have been exposed.