Steeltoe.Management.Endpoint: Query String Secrets Leak Risk
- Severity
- HIGH
- Affected component
- steeltoe.management.endpoint (nuget)
- Affected versions
- <= 4.2.0
- Patched version
- Not yet available
Steeltoe.Management.Endpoint versions up to 4.2.0 may expose secrets in query strings. Users of these versions are advised to take immediate action.
What happened
Steeltoe.Management.Endpoint's `/actuator/httpexchanges` endpoint records and displays request URIs. The masking process only covers the `UserInfo` portion and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets in query strings are returned verbatim and written to logs at DEBUG level. This issue is under investigation and has not been exploited in the wild.
The vulnerability affects versions up to 4.2.0 of steeltoe.management.endpoint. It is recommended to upgrade to the latest version or set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to mitigate the risk.
What to do about it
- Upgrade to the latest version of steeltoe.management.endpoint.
- Set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to prevent query strings from being recorded.
- Monitor the primary sources for updates on this issue.
- Review logs for any potential exposure of sensitive information.
How 0Day would have caught this
steeltoe.management.endpoint is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using steeltoe.management.endpoint version 4.2.0 or earlier, you may be affected.
What should I do right now?
Upgrade to the latest version of steeltoe.management.endpoint or set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false`.
Has an official fix been released?
No official fix has been published yet. Monitor the sources for updates.