Insecure Deployment: Unpatched Application

[inna2]

Hi, 

Our Web Inspect scan returns High vulnerability Insecure Deployment: Unpatched Application, vulnerability ID 11627. The vulnerability description is all about Spring Boot, but our web site does not use it. It is written in ASP.Net. Can anybody help me fix this issue?

How to verify or exploit the issue.

Browse to https://oursite.com:443/Shared/Find/heapdump to verify the vulnerability.

How this vulnerability affects you.

When a Spring Boot application is running, it automatically registers actuator endpoints into the routing process. For Spring Boot versions 1 - 1.4, several endpoints (such as ‘/trace', '/beans', '/env' and so on) are accessible without authentication, causing significant security issues. With Spring version 1.5 and later, all endpoints except for '/health' and '/info' are considered sensitive and secured by default. However, application developers can still disable this security.

How to remediate the issue.

Fix:
If you are using Spring Boot version 1.4 or earlier, upgrade to at least Spring Boot version 1.5.
Be sure to secure all actuator endpoints that can reveal sensitive information by granting access only to users with a dedicated role to prevent accidental exposure of endpoints to users with other roles.

[ebell]

Short of marking it as a false positive and moving on, in order for us to make a more educated analysis we would need an export of the scan with traffic. As this is the case, opening a ticket with support would be in order to collect the information for further analysis.