(cache)Lari Hotari: "The URL used had the path /management/heapdump, possibly a Spring Boot app. I never imagined that my contribution github.com/spring-proje... in 2016 would result in this disaster 9 years later. In Spring Boot, you should set management.server.port and never expose management endpoints externally."

Post

Lari Hotari

‪@lhotari.bsky.social‬

The URL used had the path /management/heapdump, possibly a Spring Boot app. I never imagined that my contribution github.com/spring-proje... in 2016 would result in this disaster 9 years later. In Spring Boot, you should set management.server.port and never expose management endpoints externally.

Add actuator endpoint to download a heapdump by lhotari · Pull Request #5670 · spring-projects/spring-boot

This adds an actuator endpoint /heapdump that creates a heap dump by using com.sun.management.HotSpotDiagnosticMXBean available at least on Oracle Java 8 and OpenJDK Java 8. It returns a compressed...

DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server micahflee.com/ddosecrets-p...

DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server

This morning, Distributed Denial of Secrets published 410 GB of data hacked from TeleMessage, the Israeli firm that makes modified versions of Signal, WhatsApp, Telegram, and WeChat that centrally arc...

micahflee.com

May 20, 2025 at 11:11 PM

Translate