Executive brief
lamp-cloud is a Java microservices framework used for rapid backend development with multi-tenant support. The framework whitelists a path pattern that allows unauthenticated users to retrieve sensitive server information including JVM system properties, classpath, filesystem paths, and OS details—data that could be leveraged to plan further attacks or locate sensitive configuration secrets.
Technical details
The vulnerability is an authentication bypass in lamp-cloud versions through 5.10.0, where the path pattern /*/anno/** is whitelisted for anonymous access. This allows unauthenticated attackers to send POST requests to endpoints like /defGenProject/anno/getProperties and retrieve the full JVM system property map without authentication. The root cause is overly permissive path whitelisting in the security configuration. The attack is network-reachable and requires no authentication or user interaction. Attackers can extract sensitive information including classpath, OS details, and potential startup secrets that aid in reconnaissance for further exploitation. Patches or version updates are recommended.
Affected products
- dromara lamp-cloud through 5.10.0
Timeline
- 2026-09-15: disclosed