Description

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-15T12:17:55.093Z",
  "pubdate": "2026-09-15T12:17:55.093Z",
  "executiveSummary": "The vulnerability identified in lamp-cloud, affecting versions through 5.10.0, is an Improper Access Control flaw that results in unauthorized sensitive information disclosure.\nThe core issue stems from an overly permissive whitelist configuration for the path pattern /*/anno/**, which allows unauthenticated access to system-level diagnostic endpoints.\nSuccessful exploitation enables remote, unauthenticated attackers to query the server and extract the complete Java Virtual Machine (JVM) system property map.\nThe potential impact of this exposure is significant, as it grants attackers access to sensitive runtime configuration data, including JVM classpath definitions, internal filesystem paths, underlying operating system details, and application startup secrets.\nThis vulnerability is classified as an information disclosure issue where the lack of authentication mechanisms on the /defGenProject/anno/getProperties endpoint permits the exfiltration of high-value environment intelligence.\nBy leveraging this information, an attacker can conduct footprinting and reconnaissance to facilitate further, more targeted attacks against the application or the host infrastructure.",
  "technicalDetails": "The vulnerability resides in the request authorization logic of lamp-cloud versions through 5.10.0. The application security framework incorrectly implements an access control whitelist that permits unauthenticated requests to the URI pattern /*/anno/**.\nSpecifically, the endpoint /defGenProject/anno/getProperties is mapped within this insecure whitelist, bypassing all required authentication and authorization filters intended for protected resources.\nThe root cause is a security misconfiguration where administrative or diagnostic functionality is inadvertently exposed to the public-facing internet due to the overly broad pattern match.\nThe exploitation flow is straightforward: an unauthenticated attacker submits a standard HTTP POST request to the target endpoint: /defGenProject/anno/getProperties. Since the request URI matches the whitelisted pattern, the application container processes the request without requiring valid session credentials or authorization tokens.\nUpon receiving the request, the underlying component retrieves the full JVM System Property Map via standard Java management interfaces and returns the data in the HTTP response body.\nThe exposed data typically includes critical environment metadata: 1) JVM Classpath configuration, which reveals structural application dependencies; 2) Absolute filesystem paths, providing insight into the server's directory architecture; 3) Detailed Operating System versions and environment variables; and 4) Startup secrets or configuration tokens that may be inadvertently injected into JVM properties at runtime.\nThe post-exploitation impact is high, as the retrieved system properties provide the attacker with a comprehensive map of the server's internal environment. This reconnaissance allows for the identification of specific software versions, potential file inclusion targets, or the discovery of hardcoded credentials and configuration keys that can be leveraged for lateral movement, privilege escalation, or full system compromise.\nThe vulnerability is active by default for any deployment using the affected versions, requiring no elevated privileges or specific interaction from a legitimate user. The exposure is network-accessible, meaning any remote actor capable of reaching the application's HTTP(S) port can trigger this disclosure."
}