GreyNoise recommends blocking malicious IPs using their threat intelligence feeds, specifically targeting SPRING BOOT ACTUATOR CRAWLER and SPRING BOOT ACTUATOR HEALTH SCANNER activities. The severity of this issue prompted the Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2025-48927 to its Known Exploited Vulnerabilities (KEV) catalog on July 14th. Of these, 1,582 IPs specifically targeted /health endpoints, commonly used by attackers to identify internet-exposed Spring Boot deployments vulnerable to exploitation. The flaw, designated CVE-2025-48927, affects government agencies and enterprises using this secure communication platform for archiving confidential messages. Disable /heapdump endpoint, block malicious IPs, upgrade Spring Boot immediately. This endpoint can return complete snapshots of heap memory, approximately 150MB in size, potentially containing plaintext usernames, passwords, and other sensitive data. The security firm created a dedicated tracking tag on July 10 to monitor these exploitation attempts. GreyNoise Research has identified significant malicious activity targeting this vulnerability. This systematic approach to identifying vulnerable systems suggests organized cybercriminal campaigns rather than opportunistic attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 18 Jul 2025 09:50:13 +0000