张惠倩 says CloudFront WAF blocks /actuator but can be bypassed by URL-encoding the path to reach Spring Boot endpoints directly.
CloudFront WAF sets a 403 interception rule for the `/actuator` path, but you can use URL encoding `/%61%63%74%75%61%74%6f%72`
to bypass the WAF and directly access Spring Boot
This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new expert voices, debates, and emerging ideas.
← Back to Cyber Security