GHSA-8phw-xrj9-cpqp Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

• NuGet Steeltoe.Management.Endpoint: < 4.3.0 → fixed in 4.3.0

Summary Steeltoe's `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through `MaskedUri`. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level. Impact Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs. Affected configuration • `httpexchanges` is explicitly added to the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`). It is not included by default. • The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. • DEBUG logging is enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only). Mitigations If an immediate upgrade is not possible: • Remove `httpexchanges` from the actuator exposure list, or restrict it behind authentication. • Set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to strip query strings from recorded exchanges entirely.