Credential Theft via Misconfigured Spring Boot Actuator Leads to SharePoint Data Exfiltration

In a recent cybersecurity incident, attackers exploited an exposed Spring Boot Actuator endpoint to harvest credentials from leaked configuration data. They utilized the OAuth2 Resource Owner Password Credentials (ROPC) flow to authenticate without multi-factor authentication (MFA), compromising a SharePoint service account. The attackers accessed sensitive information, including configuration details related to SharePoint integration, which were revealed through the unsecured /configprops endpoint. Although no plaintext credentials were directly exposed, the attackers gained valuable reconnaissance that facilitated their access. Analysts discovered that sensitive secrets for an internal application were stored in plaintext within a spreadsheet, further aiding the attackers. This incident underscores the risks associated with poor credential management and misconfigurations in cloud environments. The targeted organization experienced data exfiltration from SharePoint Online as a result of these vulnerabilities. The current status of the incident is under investigation, with recommendations for securing exposed endpoints and improving credential storage practices.

Key Points: • Attackers exploited a misconfigured Spring Boot Actuator endpoint to steal credentials. • The OAuth2 ROPC flow was used to bypass MFA and access SharePoint data. • Sensitive application secrets were stored in plaintext, exacerbating the breach.