mcp-server-semgrep/semgrep-rules/java/spring/security/audit/spring-actuator-non-health-enabled.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: spring-actuator-dangerous-endpoints-enabled
  patterns:
  - pattern: management.endpoints.web.exposure.include=$...ACTUATORS
  - metavariable-comparison:
      metavariable: $...ACTUATORS
      comparison: not str($...ACTUATORS) in ["health","*"]
  message: Spring Boot Actuators "$...ACTUATORS" are enabled. Depending on the actuators, this can pose
    a significant security risk. Please double-check if the actuators are needed and properly secured.
  severity: WARNING
  languages:
  - generic
  options:
      # Limit matches to a single line to work with a limitation of the generic parser
    generic_ellipsis_max_span: 0
  metadata:
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints
    - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785
    - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators
    category: security
    technology:
    - spring
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM