Nginx server version disclosure on engineeringblog

How it was found

Hi Yelp Team,

I have found a little information disclosure on your system with regards to the version of server you are using, due to not properly handling 404 errors , whe you go to the page that i not existing, the exact nginx version was disclosed.

PoC URL: engineeringblog.yelp.com/test

PoC Screenshot: {F33044}

It is important to keep secret of the exact server versions.

Mitigation:

You may want to create a customize 404 error page, or you can just simply remove the nginx server version.

Regards Japz