Spring Boot is a popular framework that facilitates the development of stand-alone applications and micro services. Spring Boot Actuator helps to expose production-ready support features against Spring Boot applications.

Endpoints of Spring Boot Actuator allow to monitor and interact with a Spring Boot application. Exposing unprotected actuator endpoints through configuration files can lead to information disclosure or even remote code execution vulnerability.

Rather than programmatically permitting endpoint requests or enforcing access control, frequently developers simply leave management endpoints publicly accessible in the application configuration file application.properties without enforcing any access control through Spring Security.

This is a very common issue and is also one of the highest rewarded vulnerabilities on the HackerOne platform. The query detects this issue in Spring Boot projects with Maven and application.properties, which is the most widely adopted deployment scenario.

Please consider to merge the PR. Thanks.