HexBrain

Homebrew · Report #221989

Server version disclosure on [jenkins.brew.sh]

Informativestatus
4upvotes
19 Apr 2017disclosed

How it was found

Hello Homebrew security team,

I know this is a low severity issue but I thought to get you in notice will be best. The site jenkins.brew.sh discloses the Nginx server version.

Impact The information is can be used by attacker for further finding of exploits and information gathering.

curl -i jenkins.brew.sh
HTTP/1.1 301 Moved Permanently
Server: nginx/1.6.2
Date: Tue, 18 Apr 2017 18:59:21 GMT
Content-Type: text/html
Content-Length: 184
Connection: keep-alive
Location: https://jenkins.brew.sh/

<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.6.2</center>
</body>
</html>

Fix In Ngnix configuration set:

server_tokens off;

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original