Information Disclosure in JeeWMS Boot Actuator Endpoint

Executive Summary

The vulnerability CVE-2026-11458 is an unauthenticated sensitive information disclosure in the JEEWMS software from Huayi Technology. It occurs because certain Spring Boot Actuator endpoints, specifically /base-boot/actuator/env and /base-boot/actuator/heapdump, are exposed without requiring authentication.

These endpoints can be accessed by anyone remotely, allowing attackers to retrieve critical configuration secrets, runtime environment data, and a full JVM heap dump. The /env endpoint may reveal sensitive application configuration, environment variables, database settings, and integration parameters. The /heapdump endpoint allows downloading the entire JVM heap, which can contain in-memory objects such as usernames, passwords, session tokens, API keys, and other sensitive data.

The root cause is an insecure configuration in the ShiroConfig file, where the /actuator/** path is explicitly allowed for anonymous access, enabling unauthenticated users to exploit these endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant security impacts including information disclosure of sensitive data such as credentials and session tokens.

• Attackers can extract valid usernames, passwords, API keys, and session tokens.
• It can enable privilege escalation, allowing attackers to gain higher access rights.
• It facilitates lateral movement within the internal network, increasing the scope of compromise.
• It can be chained into further remote compromise of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the sensitive Spring Boot Actuator endpoints are accessible without authentication. Specifically, you can test access to the endpoints `/base-boot/actuator/env` and `/base-boot/actuator/heapdump` to see if they return sensitive information.

• Use curl or similar HTTP client commands to request these endpoints and observe if they respond without requiring authentication.
• Example commands to test accessibility:
• curl -v http://<target-host>/base-boot/actuator/env
• curl -v http://<target-host>/base-boot/actuator/heapdump

If these endpoints return data without authentication, the system is vulnerable to information disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves restricting access to the sensitive Spring Boot Actuator endpoints to prevent unauthenticated users from accessing them.

• Configure proper access controls in the application, especially in the ShiroConfig or equivalent security configuration, to disallow anonymous access to `/actuator/**` endpoints.
• Ensure that authentication and authorization are required for accessing management endpoints such as `/base-boot/actuator/env` and `/base-boot/actuator/heapdump`.
• If possible, disable or limit exposure of these actuator endpoints in production environments.

These steps will help prevent attackers from exploiting the vulnerability to disclose sensitive information.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability CVE-2026-11458 allows unauthenticated access to sensitive information through exposed Spring Boot Actuator endpoints, potentially disclosing configuration secrets, environment variables, and sensitive in-memory data such as usernames, passwords, session tokens, and API keys.

Such unauthorized disclosure of sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over personal and sensitive information to prevent unauthorized access and data breaches.

Therefore, this vulnerability can negatively impact compliance by exposing sensitive data that should be protected under these standards, increasing the risk of regulatory penalties and loss of trust.

Useful 0 Not Useful 0