HexBrain

Weblate · Report #230633

Weblate- Banner Grabbing-Ngnix Server version

Validstatus
4upvotes
5 Jun 2017disclosed

How it was found

Hey, I have found in the HTTP response header from docs.weblate.org, the nginx web server version is disclosed.

Ideally application server responds back to users error message in customzied manner by not revealing any sensitive information about webserver or underlying components in applicatio.

Please see the below attached screenshots for issue details.

Url on which i found this issue-https://docs.weblate.org/en/latest/

Please also refer -http://nginx.org/en/security_advisories.html

For More Info refer-https://www.owasp.org/index.php/Testing_for_Web_Application_Fingerprint

Note :Revealing the specific software version of the server might allow the server machine to become more vulnerable to attacks against software that is known to contain security holes. Server implementors are encouraged to make this field a configurable option.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original