https://souljian.cn/tags/spring-boot/Recent content in Spring Boot on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088159/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088159/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Actuator 安全测试只在授权测试环境进行。</p> <h2 id="一actuator-利用链">一、Actuator 利用链 </h2><img src="https://souljian.cn/img/spring-actuator-arch.svg" alt="Spring Boot Actuator 架构" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 Actuator → ② 枚举端点 → ③ 信息收集 → ④ 利用 → ⑤ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二危险端点">二、危险端点 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">/actuator/env：查看/修改环境变量（含密码） </span></span><span class="line"><span class="cl">/actuator/heapdump：下载 JVM 堆内存（提取明文密码） </span></span><span class="line"><span class="cl">/actuator/threaddump：线程堆栈（含变量值） </span></span><span class="line"><span class="cl">/actuator/logfile：读取应用日志 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御方法">三、防御方法 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">关闭端点：management.endpoints.web.exposure.include= </span></span><span class="line"><span class="cl">加认证：Spring Security 保护 </span></span><span class="line"><span class="cl">网络隔离：不暴露公网 </span></span><span class="line"><span class="cl">WAF 拦截 /actuator/ 路径 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Actuator 信息泄露可能导致<strong>数据库密码/JWT/源码</strong>泄露，进而导致 RCE。防御核心是<strong>关闭敏感端点 + 加认证 + 网络隔离</strong>。</p>