Docker API与SpringBoot Actuator未授权访问风险分析与防范研究  

Risk Analysis and Prevention of Unauthorized Access to Docker API and SpringBoot Actuator

作　　者：贾美娟[1] 李欣 朱庆 张丽华[1] 张百顺[1] JIA Mei-juan;ZHU Qing;JIANG Shan;ZHANGLi-hua;ZHANG Bai-shun(Daqing Normal University,Daqing 163000,China)

机构地区：[1]大庆师范学院计算机科学与信息技术学院,黑龙江大庆163000

出　　处：《电脑与电信》2024年第6期22-25,30,共5页Computer & Telecommunication

基　　金：基于资源高效利用和多样化服务的网络靶场关键技术研究,项目编号:LH2021F001。

摘　　要：随着云计算技术的普及和容器化技术的发展,Docker和SpringBoot已成为现代软件开发和部署的重要工具。然而,这种广泛的使用也伴随着安全风险。针对DockerAPI与SpringBoot Actuator的未授权访问风险进行了深入分析。当这些关键组件暴露于未授权访问之下时,攻击者可能利用这些漏洞执行恶意操作,如部署恶意容器、篡改应用程序配置或窃取敏感信息。这些行为不仅可能导致服务中断和数据泄露,还可能对企业造成严重的声誉和财务损失。With the popularization of cloud computing technology and the development of containerization technology,Docker and SpringBoot have become indispensable tools for modern software development and deployment.However,this widespread use also comes with security risks.This article provides an in-depth analysis of the unauthorized access risks of Docker API and SpringBoot Actor.When these critical components are exposed to unauthorized access,attackers may exploit these vulnerabilities to perform malicious operations,such as deploying malicious containers,tampering with application configurations,or stealing sensitive information.These behaviors may not only lead to service interruption and data leakage,but also cause serious reputation and financial losses to the enterprise.

关 键 词：Docker API SpringBoot Actuator 未授权访问 风险分析与防范 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]