Executive Summary

This vulnerability exists in Steeltoe.Management.Endpoint versions prior to 4.2.0 and Steeltoe.Management.EndpointCore versions prior to 3.4.0. The issue is with the Sanitizer component in the Environment actuator, which is responsible for redacting sensitive configuration values. It only redacts values by matching configuration key names against a predefined suffix list. However, this list does not cover certain common patterns for connection strings, such as the standard .NET pattern 'ConnectionStrings:<name>' or Steeltoe Connectors' 'Steeltoe:Client:<type>:Default:ConnectionString'. Because there is no value-based scrubbing, full connection string values—including embedded passwords and user credentials—are exposed in the '/actuator/env' responses.

The vulnerability is patched in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0. Until an upgrade is possible, mitigations include removing 'env' from the actuator exposure list, adding '.*connectionstring.*' to the KeysToSanitize list, and requiring authorization on actuator endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive information such as full connection strings, including embedded passwords and user credentials, through the '/actuator/env' endpoint. An attacker with network access to this endpoint could retrieve these secrets, potentially allowing unauthorized access to databases or other connected services.

Because the vulnerability allows disclosure of confidential credentials without requiring authentication, it poses a high confidentiality risk, which could lead to data breaches or unauthorized system access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Steeltoe Management Endpoint's environment actuator (/actuator/env) is exposing full connection string values including sensitive information such as passwords in its responses.

You can verify this by querying the /actuator/env endpoint and inspecting the output for unredacted connection strings.

For example, you can use the following command to check the endpoint response:

• curl -s http://<your-server>:<port>/actuator/env | grep -i 'connectionstring'

If the response contains connection strings with embedded passwords or user credentials in clear text, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Upgrade Steeltoe.Management.Endpoint to version 4.2.0 or later, or Steeltoe.Management.EndpointCore to version 3.4.0 or later, where the issue is patched.
• If upgrading is not immediately possible, remove 'env' from the actuator exposure list to prevent the environment actuator from being accessible.
• Add '.*connectionstring.*' to the KeysToSanitize configuration to extend the sanitization to connection string keys.
• Require authorization on actuator endpoints to restrict access.

Useful 0 Not Useful 0