Spring Boot Misconfiguration: Admin MBean enabled - Vulnerability Database

Spring Boot Misconfiguration: Admin MBean enabled

Description

This Spring Boot application has the Admin MBean feature enabled through the spring.application.admin.enabled property. The Admin MBean exposes administrative operations via JMX (Java Management Extensions), allowing management and control of the application at runtime. When enabled in production environments, this feature creates an unnecessary attack surface that can be exploited by unauthorized users.

Remediation

Disable the Admin MBean feature in production environments by setting the spring.application.admin.enabled property to false. This should be configured in your Spring Boot application properties file:

For application.properties:

spring.application.admin.enabled=false

For application.yml:

spring:
  application:
    admin:
      enabled: false

If administrative features are required for production monitoring, implement them through secure, authenticated endpoints with proper access controls rather than relying on JMX MBeans. Additionally, ensure that JMX access is restricted to localhost only and protected by authentication if it must remain enabled.