The actuator ladder
// tool: probe_exposure_pathsActuators are graded, not lumped together — a reachable /actuator/health is a hint, a served heap dump is a credential leak. Each rung has its own content check, so a login page or an SPA fallback returning 200 at the same path never counts.
// RUNG 1 low
Confirms actuators are exposed at all. Low on its own — and the reason the scan then goes looking for env, mappings and heapdump.
// RUNG 2 high
Property sources, environment variables and the internal route map — routinely including secrets. Recorded as a finding, not an observation: it gates the report.
// RUNG 3 high
A JVM heap dump handed to an anonymous caller: in-memory credentials, tokens, session data and config. Confirmed on a real binary content-type and size — never a JSON or HTML error page.
// AND IT FEEDS THE REST OF THE SCAN
A reachable actuator is authoritative evidence the target runs Spring Boot, so it is recorded into the technology inventory. That changes what runs next: Java-flavoured injection payloads move to the front of the queue, the Spring and Tomcat CVE sets become applicable, and /actuator/mappings — when it is readable — hands the scan the application's real route table instead of a guessed wordlist.
The named RCEs
// tools: test_log4shell · test_text4shell · test_spring4shell · test_fastjson_rceFour of the most exploited Java vulnerabilities of the decade, each tested the way it actually triggers — and each with a guard that makes a clean target silent.
// LOG4SHELL — CVE-2021-44228 critical
A JNDI lookup is injected into the endpoint's parameters and into the headers applications actually log — User-Agent, X-Forwarded-For and friends — because the vulnerable sink is usually a log line, not a form field. Confirmation is the callback: if a vulnerable Log4j2 resolves the lookup, it reaches the collaborator. No callback, no finding — this check cannot false-positive.
// TEXT4SHELL — CVE-2022-42889 critical
Same out-of-band discipline: injected into parameters and logged headers, recorded only on a real callback. Silent without a collaborator configured.
// SPRING4SHELL — CVE-2022-22965 high
This CVE has no out-of-band lookup, so it is tested in-band as a Spring MVC data-binding differential against a same-shaped control parameter. Recorded honestly as a high-severity exposure — not a claimed remote shell.
// FASTJSON 1.x — CVE-2026-16723 critical
A JSON body carrying an attacker-controlled @type is posted to the endpoints that reach JSON.parse / JSON.parseObject — at the top level and nested inside wrapper fields, because binding to a fixed class doesn't protect an Object/Map field the gadget hides in. A vulnerable Fastjson 1.2.68–1.2.83 resolves the type and performs an outbound lookup; in a Spring Boot fat-JAR that class-resource lookup loads attacker bytecode from a nested-JAR path — needing no AutoType and no classpath gadget. Confirmation is the callback: no collaborator hit, no finding.
Container & framework CVEs
// offline dataset + optional OSV enrichmentThe stack is fingerprinted from what the server volunteers — the Server banner (Tomcat, Coyote, Jetty), a JSESSIONID cookie, an org.springframework frame in a stack trace — and every detected component with a concrete version is matched against a bundled, fully offline known-vulnerability dataset. An unknown or unparseable version is never treated as in-range, so a hardened server that suppresses its version string simply produces no CVE finding.
// EXAMPLES FROM THE BUNDLED DATASET
// OFFLINE FIRST, ONLINE OPTIONAL
The dataset ships inside the tool, so an air-gapped scan still identifies vulnerable component versions. When the host has network access, an optional OSV.dev lookup enriches the result — and when it doesn't, the scan degrades quietly instead of failing. A continuously synced full CVE feed is the Pro upgrade; the offline floor is free.
What gets recorded
// exposure · RCE · version| Finding | How NewScan confirms it | Severity |
|---|---|---|
| Log4Shell / Text4Shell | A vulnerable lookup resolves and reaches the out-of-band collaborator. | critical |
| Exposed heap dump | /actuator/heapdump returns a real binary dump anonymously. | high |
| Exposed actuator env/mappings | Property sources or the route map returned to an anonymous caller. | high |
| Spring4Shell | A classloader data-binding differential against a control parameter. | high |
| Fastjson autotype RCE | An @type gadget is resolved during JSON parsing and the server reaches the out-of-band collaborator. | critical |
| Known-vulnerable container | A verbatim Tomcat/Jetty/Spring version falls inside a dataset advisory range. | per-CVE |
| Actuator reachable | /actuator answers with an actuator document anonymously. | low |
| Stack-trace disclosure | An org.springframework trace leaks framework internals and paths. | low–medium |
How it's recorded
// audit-ready evidenceCATEGORY
Actuator exposure maps to A05 misconfiguration and CWE-200; the RCEs carry their CVE IDs straight into the report.
SEVERITY
One calibrated severity per finding that translates into each framework's risk rating and remediation SLA — no inflated numbers.
EVIDENCE
The exact request, the matched version string or confirming response, and — for the lookup RCEs — the callback that proved it.
Point it at your service.
NewScan is free and self-hosted — bring your own key. The actuator ladder, the Spring4Shell differential and the CVE matching all run in the deterministic floor with no model or provider key; Log4Shell, Text4Shell and the Fastjson autotype RCE need an OOB collaborator, which you can self-host.