High severityJavaInsecure ConfigurationMEDIUM confidence

Security Permitall Sensitive Matcher

A sensitive path (actuator, admin, management, or console) is opened to everyone with permitAll (CWE-284).

Standards mapping

CWE: CWE-284: Improper Access Control CWE-1188: Insecure Default Initialization of Resource
OWASP Top 10: A01:2021 - Broken Access Control
OWASP ASVS: V4.1.3 (L1)

Vulnerable vs. safe

Flagged by this check

http.requestMatchers("/actuator/health").permitAll();

Passes - the safe pattern

http.requestMatchers("/public/**").permitAll();

Why it matters & how to fix it

A sensitive path (actuator, admin, management, or console) is opened to everyone with permitAll (CWE-284). This exposes privileged functionality and internal data without authentication. Require authentication and an appropriate role for these matchers (e.g. hasRole("ADMIN") / EndpointRequest.toAnyEndpoint() restricted to an actuator role).

References

https://cwe.mitre.org/data/definitions/284.html

Rule ID integsec-java-security-permitall-sensitive-matcher - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks