Listen to this Post
Steeltoe’s `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level. Prior to version 4.3.0, the `Steeltoe.Management.Endpoint` /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When `Management:Endpoints:HttpExchanges:IncludeQueryString` is enabled, the `HttpExchangeRequest` response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0. The vulnerability is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The CVSS 3.1 base score is 5.9, with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack complexity is high, but the confidentiality impact is high. Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs. The affected configuration requires that `httpexchanges` is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default. The application must handle requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. DEBUG logging must be enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only). Mitigations include removing `httpexchanges` from the actuator exposure list, restricting it behind authentication, or setting `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to strip query strings from recorded exchanges entirely.
DailyCVE Form:
Platform: Steeltoe
Version: < 4.3.0
Vulnerability: Query-string secrets leak
Severity: Medium
date: 2026-09-17
Prediction: 2026-10-15
What Undercode Say:
Check if httpexchanges endpoint is exposed
curl http://localhost:8080/actuator/httpexchanges
Example response fragment showing leaked query-string secret
{
"exchanges": [
{
"request": {
"uri": "https://example.com/callback?token=secret123&user=admin"
}
}
]
}
// Vulnerable configuration in application.properties management.endpoints.web.exposure.include=httpexchanges management.endpoints.http-exchanges.include-query-string=true
Exploit: (Educational Purposes!)
Attacker requests the exposed endpoint and extracts secrets from prior traffic curl -s http://target:8080/actuator/httpexchanges | jq '.exchanges[].request.uri' | grep -E 'token|key|password'
Protection: from this CVE
Mitigation 1: Remove httpexchanges from exposure list management.endpoints.web.exposure.include=health,info Mitigation 2: Restrict endpoint behind authentication (Configure Spring Security to protect /actuator/httpexchanges) Mitigation 3: Disable query string inclusion management.endpoints.http-exchanges.include-query-string=false Mitigation 4: Upgrade to Steeltoe 4.3.0 or later
Impact:
Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
