SpringBoot Actuator未授权访问漏洞的排查和解决方法

<!-- SpringBoot Actuator -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

# 暴露监控端点
management:
  endpoints:
    web:
      exposure:
        include: '*'

#关闭全部接口
endpoints.enabled = false

###只开启某些接口
#endpoints.beans.enabled = true
#endpoints.env.enabled = true
#endpoints.trace.enabled = true
#endpoints.metrics.enabled = true

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

management.security.enabled=true
security.user.name=admin
security.user.password=admin

management.endpoints.enabled-by-default: false

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

spring.security.user.name=actuator
spring.security.user.password=actuator

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
/**
 * Actuator 监控端点权限
 *
 */
@Configuration
public class ActuatorSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().and()
                .authorizeRequests()
                    .antMatchers("/actuator/**")
                        .authenticated()
                    .anyRequest()
                        .permitAll();
        http
// 关闭csrf token认证不需要csrf防护
            .csrf().disable()
// 关闭Session会话管理器 JWT 不需要
            .sessionManagement().disable()
// 关闭记住我功能 JWT 不需要
            .rememberMe().disable();
    }
}