CVE-2025-53602: 
Java vulnerability analysis and mitigation

CVE-2025-53602 is an insecure default initialization vulnerability in Zipkin (the open-source distributed tracing system) that exposes a /heapdump endpoint via Spring Boot Actuator. All versions through 3.5.1 of the io.zipkin:zipkin-server Maven package are affected. The vulnerability was published on July 4, 2025, with a patch merged on June 14, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), and is analogous to CVE-2025-48927 (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-1188 (Initialization of a Resource with an Insecure Default): Zipkin's Spring Boot Actuator configuration did not explicitly disable the HeapDumpWebEndpointAutoConfiguration, leaving the /heapdump endpoint accessible by default without authentication. The fix, implemented in commit 3c7605d, removes HeapDumpWebEndpointAutoConfiguration from the active autoconfiguration list and adds it to the Spring exclusion list in zipkin-server-shared.yml, effectively disabling the endpoint (GitHub Commit, GitHub PR #3804). No authentication or special privileges are required to exploit this endpoint — a simple unauthenticated HTTP GET request is sufficient.

Successful exploitation allows an unauthenticated remote attacker to download a full JVM heap dump from the Zipkin server by accessing the /heapdump endpoint. The heap dump may contain sensitive runtime data including in-memory credentials, API keys, tracing metadata, internal service topology details, and other application secrets. While there is no integrity or availability impact, the confidentiality exposure can facilitate further attacks such as credential harvesting or lateral movement within the monitored infrastructure (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability is trivially exploitable by any unauthenticated network attacker with access to the Zipkin server's management port, requiring only a standard HTTP GET request. The EPSS score is approximately 0.028% (0.00027), placing it in the 52nd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or internally accessible Zipkin server instances (versions ≤ 3.5.1) using tools like Shodan, Censys, or internal network scanning. Zipkin typically listens on port 9411.
2. Verify endpoint availability: Send an HTTP GET request to http://<zipkin-host>:9411/actuator/heapdump or http://<zipkin-host>:9411/heapdump to confirm the endpoint is accessible and returns a binary heap dump file.
3. Download heap dump: Use curl or a browser to download the heap dump: curl -o heapdump.hprof http://<zipkin-host>:9411/actuator/heapdump.
4. Analyze heap dump: Open the .hprof file with tools such as Eclipse Memory Analyzer (MAT), VisualVM, or jhat to search for sensitive strings including passwords, tokens, API keys, and internal service addresses stored in JVM memory (GitHub Advisory, GitHub Commit).

• Network: Unauthenticated HTTP GET requests to /actuator/heapdump or /heapdump on the Zipkin server port (default 9411); large outbound HTTP responses (heap dumps can be hundreds of MB) to unexpected client IPs.
• Logs: Zipkin or embedded web server access logs showing GET /actuator/heapdump or GET /heapdump requests with HTTP 200 responses from external or unexpected source IPs.
• Process: Elevated JVM memory activity or temporary spike in CPU usage on the Zipkin process coinciding with heap dump generation requests.

Upgrade Zipkin server to a version beyond 3.5.1 that includes the fix from commit 3c7605d, which explicitly disables HeapDumpWebEndpointAutoConfiguration (GitHub Commit). As an immediate workaround prior to upgrading, restrict network access to the Zipkin management port (default 9411) using firewall rules or network policies to allow only trusted administrative hosts. Additionally, configure Spring Boot Actuator to exclude the heapdump endpoint by adding org.springframework.boot.actuate.autoconfigure.management.HeapDumpWebEndpointAutoConfiguration to the spring.autoconfigure.exclude list in your application configuration.

The vulnerability received routine coverage from security aggregators and vulnerability databases shortly after disclosure. RedPacketSecurity noted the CVE on Mastodon, and Red Hat published a tracking advisory. No significant vendor statements or notable researcher commentary beyond the patch PR discussion have been identified.