#vulns.co
/
mcp by GKData.io

← Back to Gadgets

Debug / actuator / env endpoint

Spring actuator, Django debug, /server-status, /phpinfo, /.git, /graphql introspection, /_next/data, /api/__debug, telescope, horizon, flask-debug, graphql playground.

Tags: debug, info-leak, secrets

Typical severity: P2-P4

What it becomes

Information leak alone is P4. Env with cloud keys, heap dumps, or gateway routes is a foothold.

Where to look

  • staging hostnames
  • admin vhosts
  • forgotten prefixes /api/internal
  • IAP-gated but not actually gated

Chains

  • RCE / SSRF — Spring gateway + heapdump, Actuator env + refresh, GraphQL debug to nested SSRF.
  • Secret leak — env, config, .git, source maps, firebase config, AWS keys in JS.
  • Auth bypass — Debug routes skip the auth middleware the public routes use.

Notes

  • Nuclei has a dense debug/exposed-panel set. Run it, then actually open the interesting 200s.
  • Source maps next to production bundles are a JS-review gadget, not a finding by themselves.

← Back to Gadgets