Gratipay · Report #157507
nginx version disclosure on downloads.gratipay.com
Informativestatus
4upvotes
18 May 2017disclosed
Summary
The researcher @footstep found that the web server behind downloads.gratipay.com (nginx) is disclosing its version on error pages. However, this domain is hosted on a third-party infrastructure, MaxCDN—making this impossible to fix and out-of-scope of our program.
Test Test! ;) n00b Mode :D
How it was found
Hello,
Navigating to http://downloads.gratipay.com/Error goes to a 404 error page disclosing your Nginx version. Server information should be protected since anyone with a bad intent on would try to find exploit for the specified server version.
Thanks, Footstep