CVE-2025-8738: Microservices-Platform Info Disclosure

CVE-2025-8738 Overview

CVE-2025-8738 is an information disclosure vulnerability in the zlt2000 microservices-platform project up to version 6.0.0. The flaw resides in the Spring Actuator Interface exposed at the /actuator endpoint. An unauthenticated remote attacker can query the endpoint to retrieve internal application details without any privileges or user interaction. The exploit has been publicly disclosed, increasing the risk of opportunistic scanning against exposed deployments. The weakness is categorized as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote unauthenticated attackers can access /actuator endpoints to enumerate configuration, environment variables, and internal application state useful for follow-on attacks.

Affected Products

zlt2000 microservices-platform versions up to and including 6.0.0
Spring Boot Actuator interface exposed by the platform
Any downstream deployment leaving the /actuator endpoint reachable without authentication

Discovery Timeline

2025-08-08 - CVE-2025-8738 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8738

Vulnerability Analysis

The vulnerability affects the Spring Actuator Interface bundled with the zlt2000 microservices-platform. Spring Boot Actuator exposes management endpoints under the /actuator path that report on application health, configuration, metrics, and runtime state. In affected versions, these endpoints are reachable over the network without authentication controls enforced. An attacker sending HTTP requests to /actuator and its sub-paths can enumerate available management endpoints. Depending on which endpoints are enabled, the response data can include environment variables, bean definitions, configuration properties, and thread dumps. This information supports reconnaissance and can accelerate lateral movement or credential harvesting.

Root Cause

The root cause is missing access control on management endpoints. The application ships with Spring Boot Actuator enabled and exposed on the primary HTTP interface without requiring authentication. Sensitive endpoints such as env, configprops, beans, and heapdump may leak credentials, connection strings, or internal service topology when enabled. This is a classic [CWE-200] information exposure pattern driven by insecure default configuration.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues an HTTP GET request to the /actuator path on the exposed service. The server responds with a JSON index of available management endpoints. The attacker then iterates through each endpoint to harvest configuration and runtime data. Because the exploit has been publicly disclosed via VulDB entry 319234 and the associated GitHub issue, automated scanners are likely to include this pattern in their signatures. See the GitHub Issue Discussion for public technical details.

Detection Methods for CVE-2025-8738

Indicators of Compromise

HTTP GET requests to /actuator, /actuator/env, /actuator/configprops, /actuator/beans, or /actuator/heapdump from external sources
Unexpected JSON responses containing Spring Boot management endpoint indexes served to untrusted clients
User-Agent strings associated with vulnerability scanners probing for exposed actuator endpoints

Detection Strategies

Inspect web server and reverse proxy access logs for repeated requests to /actuator* paths originating from public IP ranges
Deploy WAF rules that flag or block unauthenticated requests to management endpoints
Correlate outbound HTTP responses containing mappings, env, or heapdump payloads with external client sessions

Monitoring Recommendations

Ingest application access logs into a centralized analytics platform and alert on /actuator request patterns
Track authentication state on requests to management ports and endpoints
Baseline normal internal traffic to actuator endpoints so external probes generate high-fidelity alerts

How to Mitigate CVE-2025-8738

Immediate Actions Required

Restrict network access to the /actuator endpoint using firewall rules, ingress controllers, or reverse proxy allow-lists
Disable non-essential actuator endpoints and expose only health and info publicly if required
Require authentication and authorization on all management endpoints via Spring Security configuration

Patch Information

No official patch has been published by the zlt2000 microservices-platform project for CVE-2025-8738 at the time of writing. Track the GitHub Issue Discussion and the VulDB entry #319234 for remediation updates. Until a fix is available, apply the configuration workarounds below.

Workarounds

Set management.endpoints.web.exposure.include=health,info in application.yml to limit exposed endpoints
Bind management endpoints to a separate internal port using management.server.port and management.server.address
Place the application behind an authenticated reverse proxy that denies external requests to /actuator*
Add Spring Security rules requiring an authenticated role for the /actuator/** path pattern

bash

# Configuration example - application.yml
management:
  endpoints:
    web:
      exposure:
        include: health,info
      base-path: /internal-actuator
  server:
    port: 8081
    address: 127.0.0.1
  endpoint:
    health:
      show-details: never