Information Disclosure via X-Server-Powered-By Header

Description

The 'X-Server-Powered-By' header indicates which platform or server software the application is running on (e.g., Tomcat, Jetty, Node.js). By exposing this information, attackers can pinpoint known vulnerabilities or misconfigurations relevant to the disclosed platform. They may also craft exploits or social engineering tactics targeting specific server versions or default configurations. Ultimately, disclosing 'X-Server-Powered-By' increases the application’s attack surface by providing adversaries with a clear entry point to focus their reconnaissance and attack strategies.

Remediation

Remove or mask the 'X-Server-Powered-By' header so that external requests do not discover your underlying server platform. Adjust your server or framework configuration to avoid adding this header to responses. If reverse proxies, CDNs, or load balancers are in use, ensure they do not preserve or re-inject it. Keep your server software updated with security patches and regularly review configurations to mitigate known exploits. Consider employing a Web Application Firewall (WAF) or intrusion detection system to detect malicious traffic aiming at server-specific flaws. Periodically audit response headers to confirm that no unnecessary platform details are leaked.

References

Severity

Owasp

Code: A05:2021

Category: Security Misconfiguration

Classification