概要
Security through obscurity is the most expensive kind. Every debug endpoint that ships to production behind nothing but 'no one will guess the URL' is a future post-mortem. The bug shape is consistent across stacks: framework provides a powerful dev tool (Spring Boot Actuator's `/env`, Django Debug Toolbar, ASP.NET trace.axd, Express's morgan logger, Apache's mod_status), developer enables it for local debugging, deploy pipeline ships the same config to production, attacker scans well-known paths and walks in. Spring4Shell, dozens of CVE-class disclosures, and entire breach categories trace back to this pattern.
仕組み
We probe ~31 well-known paths covering the major framework defaults: Spring Actuator (`/actuator`, `/actuator/env`, `/actuator/heapdump`, `/actuator/loggers`, `/actuator/trace`), Apache mod_status (`/server-status`, `/server-info`), nginx stub_status (`/nginx_status`), Django (`/admin/`, `/__debug__/`), Express dev tools (`/_debug`, `/debug`), .NET (`/trace.axd`, `/elmah.axd`), generic admin paths (`/admin`, `/dashboard`, `/console`), Kubernetes-adjacent paths (`/metrics`, `/healthz/?verbose=true`), database admin tools (`/phpmyadmin`, `/adminer.php`). Each probe checks for content matching the expected debug payload — a Spring Actuator response has distinctive JSON shape, Django admin has distinctive HTML, etc.
バリエーション
Spring Boot Actuator
`/actuator/env` leaks every config var. `/actuator/heapdump` lets the attacker pull a memory snapshot containing secrets. Spring4Shell-class CVEs lurk here.
Apache mod_status
Shows current request URLs in real time, including sensitive paths and parameters. Visiting `/server-status?refresh=1` is a live wiretap.
Database admin tools
phpMyAdmin, Adminer, Robo 3T web — installed by 'just for a moment' decisions and never removed. Direct database access if not auth-gated.
Cloud / K8s metrics endpoints
`/metrics` exposed without auth leaks request rates, error counts, and (with verbose configs) request paths. Used for recon in target prioritization.
被害範囲
Tracks the endpoint. Spring `/actuator/env` is every config var, including secrets. `/actuator/heapdump` is a memory snapshot from which the attacker recovers session tokens, encryption keys, and credentials. Apache `/server-status` is a live wiretap. Django `/admin/` without authentication is database access. Even read-only metrics endpoints leak operational signal that helps attackers time exploits during peak load when defender attention is divided.
// what fixvibe checks
What FixVibe checks
FixVibe maps externally visible application surfaces with passive signals and safe metadata checks. Reports summarize the exposed surface and remediation priorities. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Block these paths at the edge — your CDN or WAF should refuse `/actuator/*`, `/server-status`, `/admin/`, `/__debug__`, etc., before they reach origin. Bind admin interfaces to internal network only (VPC private subnet, VPN-required IP allowlist). Require authentication on any management endpoint, even ones you think are 'just for monitoring.' For Spring Boot, set `management.server.port` to a separate port not exposed to the internet, plus `management.endpoints.web.exposure.include=health,info` to limit what's published. For Django, ensure `DEBUG=False` in production and remove `django-debug-toolbar` from `INSTALLED_APPS`. For Apache/nginx, comment out the status modules entirely if you don't actively use them. Audit your route table for any path containing 'debug', 'admin', 'console', '.well-known/server-info', and gate or remove each.