# Unauthenticated debug and management endpoints

Debug, actuator, DevTools or daemon ports reachable without auth, exposing commands, tokens or secrets

_Area: Web infrastructure and server-side requests. Seen in 6 disclosed reports; 2 confirmed bounties: $1,550 and $5,000; latest 2025-07-02. Updated 2026-10-23._

## How it works
A service built for local development or operators listens on a reachable interface with authentication off. The design assumption is "only trusted operators can reach this port," but network placement (public IP, shared host, permissive firewall) or a second reachability path (a rendered page, a local process) breaks it. Reachability then equals control for endpoints that execute commands or return secrets; for read-only endpoints it still means disclosure.

## Where it shows up
- Auth-off-by-default debug protocols: JDWP `address=*:5005`, JMX `authenticate=false`, Chromium DevTools `/json/version` and `/json/new` [E1](https://bugbountylibrary.com/r/blog%3Acanvatechblog-com-discovering-headroll-cve-2023-0704-in-chromium-2e7f66fc130c.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-jdwp-exploited-in-the-wild.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md)
- Local CLI daemons with unauthenticated privileged RPCs (stripe-cli gRPC `Listen`) [E5](https://bugbountylibrary.com/r/h1%3A1369191.md)
- Debug features shipped in production builds, relaunched with profile-restore flags [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md)
- Misconfiguration-only (not auth-off-by-default): Actuator `/heapdump` and `/env` on custom paths [E3](https://bugbountylibrary.com/r/h1%3A862589.md); Laravel DebugBar and `.env` left on in production [E4](https://bugbountylibrary.com/r/blog%3Ajohnjhacking-com-blog-p1-critical-discovering-and-foiling-a-threat-actor.md)
- Triage signals: `address=*`, `authenticate=false`, `--remote-debugging-port`, high random localhost ports on shared hosts [E1](https://bugbountylibrary.com/r/blog%3Acanvatechblog-com-discovering-headroll-cve-2023-0704-in-chromium-2e7f66fc130c.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-jdwp-exploited-in-the-wild.md)[E5](https://bugbountylibrary.com/r/h1%3A1369191.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md)

## How to review
Check the invariant: every debug/management listener must require authentication AND be unreachable from untrusted networks and untrusted local callers. Enumerate listening ports and match each to its process command line; confirm the bind address is loopback or a private interface, not `*` or a public IP; confirm firewall/security-group rules do not expose it; confirm auth is enabled (JDWP/JMX flags, notebook token, gRPC auth). For shared hosts, verify tenant network isolation. For services that render untrusted content, treat the browser's own localhost ports as an attack path [E1](https://bugbountylibrary.com/r/blog%3Acanvatechblog-com-discovering-headroll-cve-2023-0704-in-chromium-2e7f66fc130c.md). Treat any endpoint that can execute commands or return credentials as RCE-equivalent; read-only endpoints as disclosure.

## Variants seen
- Headless browser DevTools reachable from rendered pages [E1](https://bugbountylibrary.com/r/blog%3Acanvatechblog-com-discovering-headroll-cve-2023-0704-in-chromium-2e7f66fc130c.md)
- JDWP debug agent exposed to the internet [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-jdwp-exploited-in-the-wild.md)
- Actuator endpoints on a custom path leaking heap and env secrets [E3](https://bugbountylibrary.com/r/h1%3A862589.md)
- Laravel DebugBar and `.env` leaking credentials and JWTs [E4](https://bugbountylibrary.com/r/blog%3Ajohnjhacking-com-blog-p1-critical-discovering-and-foiling-a-threat-actor.md)
- Local CLI gRPC daemon without auth [E5](https://bugbountylibrary.com/r/h1%3A1369191.md)
- Chrome remote debugging port abused post-exploitation [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md)

## Impact and severity
Led to RCE, cryptomining, credential and token theft, and account takeover [E1](https://bugbountylibrary.com/r/blog%3Acanvatechblog-com-discovering-headroll-cve-2023-0704-in-chromium-2e7f66fc130c.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-jdwp-exploited-in-the-wild.md)[E3](https://bugbountylibrary.com/r/h1%3A862589.md)[E4](https://bugbountylibrary.com/r/blog%3Ajohnjhacking-com-blog-p1-critical-discovering-and-foiling-a-threat-actor.md)[E5](https://bugbountylibrary.com/r/h1%3A1369191.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md). Severity is high to critical. Worse when internet-facing and actively scanned (exploited within hours [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-jdwp-exploited-in-the-wild.md)), when it yields cloud or account tokens [E3](https://bugbountylibrary.com/r/h1%3A862589.md), or when it inherits the victim's authenticated browser profile [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Acanvatechblog-com-discovering-headroll-cve-2023-0704-in-chromium-2e7f66fc130c.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-jdwp-exploited-in-the-wild.md
- E3: https://bugbountylibrary.com/r/h1%3A862589.md
- E4: https://bugbountylibrary.com/r/blog%3Ajohnjhacking-com-blog-p1-critical-discovering-and-foiling-a-threat-actor.md
- E5: https://bugbountylibrary.com/r/h1%3A1369191.md
- E6: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control.md