How to remediate – Spring Boot Actuator HikariCP Remote Code Execution

1. Introduction

Spring Boot Actuator HikariCP Remote Code Execution allows an unauthenticated attacker to run code on systems using the Spring Boot framework with exposed actuator endpoints and a default HikariCP database connection pool, often in conjunction with the H2 Database Engine. This poses a critical risk to confidentiality, integrity, and availability of affected systems. Java-based microservice applications are typically impacted. A successful exploit could lead to complete system compromise.

2. Technical Explanation

The vulnerability occurs because Spring Boot’s Actuator endpoint can expose environment information and allow restarts. When combined with default HikariCP settings, it allows an attacker to manipulate the database connection pool configuration. This manipulation enables code execution via a common Java development database like H2. The exploit requires the actuator endpoint to be accessible and unauthenticated.

• Root cause: The Spring Boot Actuator exposes sensitive endpoints by default without authentication. HikariCP uses insecure defaults, allowing external configuration changes.
• Exploit mechanism: An attacker sends a crafted request to the actuator endpoint to modify the database connection URL to point to an H2 database with a malicious script embedded in its initialization parameters. This script is then executed when the application restarts or reloads the context.
• Scope: Applications using Spring Boot versions with exposed Actuator endpoints and default HikariCP configurations are affected, particularly those utilizing the H2 Database Engine for development or testing.

3. Detection and Assessment

Confirming vulnerability requires checking actuator endpoint exposure and authentication status. A thorough assessment involves reviewing application configuration.

• Quick checks: Use curl to check if the actuator endpoint is accessible: curl http://your-application-url/actuator/env. If it returns data without requiring a login, it’s likely exposed.
• Scanning: Nessus plugin ID 16783 and other vulnerability scanners may detect this issue based on Spring Boot version detection and endpoint exposure. These are examples only.
• Logs and evidence: Examine application logs for requests to the actuator endpoints, specifically those involving environment or restart operations. Look for unusual database connection strings.

curl http://your-application-url/actuator/env

4. Solution / Remediation Steps

The primary solution is to secure the actuator endpoint or disable it if not needed. Implement Spring Security for authentication.

4.1 Preparation

• Ensure you have access to revert configuration changes if necessary. A roll back plan involves restoring the previous snapshot or reverting config files.
• A change window may be required for production systems, with approval from the security team.

4.2 Implementation

1. Step 1: Disable the actuator endpoint if it is not required by setting management.security.enabled=true in your application’s configuration file (e.g., application.properties or application.yml).
2. Step 2: If the actuator endpoint is needed, secure it using Spring Security by adding appropriate authentication and authorization rules to your application’s security configuration.

4.3 Config or Code Example

Before

management.security.enabled=false

After

management.security.enabled=true

4.4 Security Practices Relevant to This Vulnerability

Several security practices can mitigate this vulnerability type.

• Practice 1: Least privilege – restrict access to sensitive endpoints like the actuator endpoint only to authorized users and services.
• Practice 2: Secure defaults – avoid using insecure default configurations for components like HikariCP, and always configure them with strong security settings.

4.5 Automation (Optional)

Configuration management tools can automate the application of these fixes.

# Example Ansible task to set management.security.enabled=true
- name: Secure Spring Boot Actuator endpoint
  lineinfile:
    path: /path/to/application.yml
    regexp: '^management.security.enabled:'
    line: 'management.security.enabled: true'
  notify: Restart application

5. Verification / Validation

Confirm the fix by verifying that the actuator endpoint requires authentication and is no longer accessible without credentials.

• Post-fix check: Run curl http://your-application-url/actuator/env again. It should now return a 401 Unauthorized error or require valid credentials.
• Re-test: Repeat the initial detection method (checking actuator endpoint accessibility) to confirm it is no longer exposed without authentication.
• Monitoring: Monitor application logs for failed authentication attempts on the actuator endpoints.

curl http://your-application-url/actuator/env

6. Preventive Measures and Monitoring

Proactive measures can prevent similar vulnerabilities.

• Baselines: Update security baselines to include secure configuration settings for Spring Boot applications, specifically regarding the actuator endpoint and database connection pools.
• Pipelines: Integrate SAST tools into CI/CD pipelines to identify insecure configurations or code patterns related to exposed endpoints and default credentials.
• Asset and patch process: Implement a regular patch review cycle for all application dependencies, including Spring Boot, to address known vulnerabilities promptly.

7. Risks, Side Effects, and Roll Back

Disabling the actuator endpoint may impact monitoring or management features. Securing it requires careful configuration of Spring Security.

• Risk or side effect 1: Disabling the actuator endpoint might require alternative methods for application monitoring and management.
• Risk or side effect 2: Incorrectly configuring Spring Security could lock out legitimate users or services from accessing necessary functionality.
• Roll back: If disabling the actuator causes issues, revert the configuration change by setting management.security.enabled=false in your application’s configuration file and restarting the application.

8. References and Resources

Links to resources related to this specific vulnerability.

• Vendor advisory or bulletin: https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database
• NVD or CVE entry: No specific CVE is referenced in the provided context.
• Product or platform documentation relevant to the fix: Spring Boot Security Documentation