Sensitive Info Disclosure ( unauthenticated Spring Boot Admin & actuator)

[NinjaGPT]

Summary

The latest version (v3.3.4) of xboot allows unauthenticated access to both Spring Boot Admin and Spring Actuator, resulting in the exposure of extensive server configuration information and environment variables.

POC

http://127.0.0.1:8888/xboot/admin/wallboard
http://127.0.0.1:8888/xboot/actuator