Every day, Inspectiv uncovers brand-new vulnerabilities across diverse environments. These findings aren’t theoretical—they’re active weaknesses that attackers would happily exploit today. By learning from fresh discoveries as they emerge, you can harden your systems before adversaries notice.
Below are three high-impact issues recently identified across customer environments, along with the practical defenses your teams can apply immediately. Note some details have been changed for educational purposes.
Attackers love predictability. When object identifiers are short, sequential, or guessable, even limited authentication can accidentally grant access to data that should be off-limits. Enumeration becomes trivial—and once attackers find one valid object ID, they can often harvest many more.
IDOR attacks continue to be one of the most common (and devastating) real-world application flaws. These patterns were observed just this week, demonstrating how often predictable IDs slip into production systems unnoticed.
Finally, here’s a sample HTTP request that should help avoid this kind of attack.
POST /directory1/directory2/action/{numerical-ID-1}/sample HTTP/2 Host: sample-app.com
{"id":{numerical-ID-2}}
Note each object should be checked for proper ACLs. And of course numerical incrementing should not result in a successful result.
Attackers always look for shortcuts—and default framework features often hand them over on a silver platter. One recent finding involved an exposed heapdump endpoint, providing deep insight into the application’s internal state.
Heapdumps can contain secrets, credentials, tokens, or sensitive user data. If an attacker can download one without authentication, they gain a treasure map of your application’s internals. This comes up for Go, Java JMX, and Spring Boot Actuator, all of which ship with some level of default heapdumps in current or near-current versions.
Spring Boot Actuator
management.endpoint.heapdump.enabled=false
Go
Go pprof
wrap handlers or remove in production
Java JMX
Node
never run --inspect on a public interface
This one is as bad as it sounds—an administrative interface accessible without authentication. Even limited admin functionality in the open can lead directly to account takeover, data manipulation, or full environment compromise.
Attackers routinely scan for common admin paths. If one answers without a login challenge, compromise becomes nearly instantaneous. This is a “red flag” vulnerability we still find far too often.