Skip to content

Endpoint Exposure Analyzer

Configuration Name: EndpointExposure

The Endpoint Exposure Analyzer detects unintended management, diagnostic, and debug endpoints in popular application frameworks, helping teams secure sensitive paths before deployment.

Framework Coverage

  • Spring Boot
  • Jakarta
  • Quarkus
  • Micronaut
  • Flask
  • Werkzeug
  • Django
  • Express
  • ASP .NET Core
  • Ruby on Rails
  • Laravel
  • Symfony

How It Works

  1. URL Construction
    Builds target URLs by combining the application’s base address with each framework’s common endpoint paths.

  2. Request Strategy
    Executes GET requests both with and without available authorization credentials.

  3. Detection & Reporting
    Flags any endpoint where the request returns a successful response, indicating potential exposure.

By automating these checks, the analyzer empowers developers to lock down or remove vulnerable endpoints well before they reach production.

Faults Reported

Fault Identifier Title Summary Solution Severity
CWE-497 Endpoint exposes application details An endpoint exposes sensitive application details or control of the application. Disable debug modes and administration consoles. If such functionality is required, then bind the endpoints to localhost or a protected network, and restrict access to only administrative users. medium