Volkswagen data leak through Spring Boot Actuator misconfiguration

Researchers found a data exposure issue within Volkswagen’s environment by leveraging tools such as Subfinder, GoBuster, and Spring. Using these tools, they found a Java Spring application exposing its Heap dump file. Heap dumps, which list various objects within a Java Virtual Machine (JVM), are typically used for monitoring performance metrics and introspection but can inadvertently expose sensitive information.

In this case, the heap dump contained active AWS credentials stored in plain text.