CodeQL query to detect open Spring Boot actuator endpoints

CVE ID(s)

There's no CVE for this.

I created a query to detect open (unauthenticated) Spring Boot actuators that can lead to sensitive information disclosure or even RCE.

The details are present in PR: github/codeql#2901

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

github/codeql#2901 is aleady merged. Is there anything else I need to do?

Created Hackerone report 891266 for bounty 221136 : [42] CodeQL query to detect open Spring Boot actuator endpoints
🎉

@xcorail

Thank you, @xcorail.

Big huy