{"action":"closed","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/2476","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/2476/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/2476/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/2476/events","html_url":"https://github.com/spring-projects/spring-boot/issues/2476","id":57155845,"number":2476,"title":"Requests to JolokiaMvcEndpoint bypass security filter, allowing unauthenticated remote access to JMX","user":{"login":"christianbauer","id":1006685,"avatar_url":"https://avatars.githubusercontent.com/u/1006685?v=3","gravatar_id":"","url":"https://api.github.com/users/christianbauer","html_url":"https://github.com/christianbauer","followers_url":"https://api.github.com/users/christianbauer/followers","following_url":"https://api.github.com/users/christianbauer/following{/other_user}","gists_url":"https://api.github.com/users/christianbauer/gists{/gist_id}","starred_url":"https://api.github.com/users/christianbauer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christianbauer/subscriptions","organizations_url":"https://api.github.com/users/christianbauer/orgs","repos_url":"https://api.github.com/users/christianbauer/repos","events_url":"https://api.github.com/users/christianbauer/events{/privacy}","received_events_url":"https://api.github.com/users/christianbauer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/blocker","name":"blocker","color":"e11d21"},{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"wilkinsona","id":914682,"avatar_url":"https://avatars.githubusercontent.com/u/914682?v=3","gravatar_id":"","url":"https://api.github.com/users/wilkinsona","html_url":"https://github.com/wilkinsona","followers_url":"https://api.github.com/users/wilkinsona/followers","following_url":"https://api.github.com/users/wilkinsona/following{/other_user}","gists_url":"https://api.github.com/users/wilkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/wilkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilkinsona/subscriptions","organizations_url":"https://api.github.com/users/wilkinsona/orgs","repos_url":"https://api.github.com/users/wilkinsona/repos","events_url":"https://api.github.com/users/wilkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/wilkinsona/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/32","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/32/labels","id":900006,"number":32,"title":"1.1.11","description":"","creator":{"login":"philwebb","id":519772,"avatar_url":"https://avatars.githubusercontent.com/u/519772?v=3","gravatar_id":"","url":"https://api.github.com/users/philwebb","html_url":"https://github.com/philwebb","followers_url":"https://api.github.com/users/philwebb/followers","following_url":"https://api.github.com/users/philwebb/following{/other_user}","gists_url":"https://api.github.com/users/philwebb/gists{/gist_id}","starred_url":"https://api.github.com/users/philwebb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philwebb/subscriptions","organizations_url":"https://api.github.com/users/philwebb/orgs","repos_url":"https://api.github.com/users/philwebb/repos","events_url":"https://api.github.com/users/philwebb/events{/privacy}","received_events_url":"https://api.github.com/users/philwebb/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":41,"state":"open","created_at":"2014-12-11T04:46:17Z","updated_at":"2015-02-12T17:56:32Z","due_on":"2015-02-19T08:00:00Z","closed_at":null},"comments":1,"created_at":"2015-02-10T10:26:15Z","updated_at":"2015-02-12T17:56:33Z","closed_at":"2015-02-12T17:56:32Z","body":"Configuration:\r\n\r\n```\r\nmanagement.security.enabled=true\r\nendpoints.jolokia.sensitive=true\r\nsecurity.user.name=admin\r\nsecurity.user.password=admin\r\n```\r\n(I had to set endpoints.jolokia.sensitive to get any protection for the /jolokia endpoint, that was also surprising. I'd have thought that enabling management security would be enough.)\r\n\r\nStartup log:\r\n\r\n```\r\n11:09:11.033 | INFO  | main       | etty.server.handler.ContextHandler$Context:2050 | jolokia: No access restrictor found at classpath:/jolokia-access.xml, access to all MBeans is allowed\r\n...\r\n11:09:54.391 | INFO  | main       | rk.security.web.DefaultSecurityFilterChain:  28 | Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/health'], Ant [pattern='/health/'], Ant [pattern='/health.*'], Ant [pattern='/info'], Ant [pattern='/info/'], Ant [pattern='/info.*'], Ant [pattern='/metrics'], Ant [pattern='/metrics/'], Ant [pattern='/metrics.*'], Ant [pattern='/autoconfig'], Ant [pattern='/autoconfig/'], Ant [pattern='/autoconfig.*'], Ant [pattern='/shutdown'], Ant [pattern='/shutdown/'], Ant [pattern='/shutdown.*'], Ant [pattern='/jolokia'], Ant [pattern='/jolokia/'], Ant [pattern='/jolokia.*']...\r\n```\r\n\r\nThe URL /jolokia is indeed secured:\r\n\r\n```\r\n1:14:37.352 | DEBUG | 8828668-37 | ity.web.util.matcher.AntPathRequestMatcher: 145 | Checking match of request : '/jolokia'; against '/jolokia'\r\n11:14:37.352 | DEBUG | 8828668-37 | security.web.util.matcher.OrRequestMatcher:  68 | matched\r\n...\r\n11:14:37.366 | DEBUG | 8828668-37 | cess.intercept.AbstractSecurityInterceptor: 194 | Secure object: FilterInvocation: URL: /jolokia; Attributes: [hasRole('ROLE_ADMIN')]\r\n...\r\n11:14:37.376 | DEBUG | 8828668-37 | rity.web.access.ExceptionTranslationFilter: 165 | Access is denied (user is anonymous); redirecting to authentication entry point\r\n```\r\n\r\nThe actually sensitive jolokia paths are however not secured, e.g. /jolokia/list/java.lang/type=Memory:\r\n\r\n```\r\n11:18:14.132 | DEBUG | 8828668-39 | security.web.util.matcher.OrRequestMatcher:  65 | Trying to match using Ant [pattern='/jolokia']\r\n11:18:14.132 | DEBUG | 8828668-39 | ity.web.util.matcher.AntPathRequestMatcher: 145 | Checking match of request : '/jolokia/list/java.lang/type=memory'; against '/jolokia'\r\n11:18:14.132 | DEBUG | 8828668-39 | security.web.util.matcher.OrRequestMatcher:  65 | Trying to match using Ant [pattern='/jolokia/']\r\n11:18:14.132 | DEBUG | 8828668-39 | ity.web.util.matcher.AntPathRequestMatcher: 145 | Checking match of request : '/jolokia/list/java.lang/type=memory'; against '/jolokia/'\r\n11:18:14.132 | DEBUG | 8828668-39 | security.web.util.matcher.OrRequestMatcher:  65 | Trying to match using Ant [pattern='/jolokia.*']\r\n11:18:14.132 | DEBUG | 8828668-39 | ity.web.util.matcher.AntPathRequestMatcher: 145 | Checking match of request : '/jolokia/list/java.lang/type=memory'; against '/jolokia.*'\r\n...\r\n11:18:14.133 | DEBUG | 8828668-39 | security.web.util.matcher.OrRequestMatcher:  72 | No matches found\r\n```\r\n\r\nIs a blacklist a good strategy for securing a management API?\r\n"}}