Description
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dromara | lamp-cloud | ≤ 5.10.0 | — |
References
- Researcher write-up third-party-advisory exploit
- IgnoreProperties.java anonymous-path whitelist technical-description
- DefGenProjectController.getProperties technical-description
- https://github.com/dromara/lamp-cloud product
- VulnCheck Advisory: lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint third-party-advisory