Server Information Disclosure via X-Powered-By HTTP Header/ CWE: 200 – Information Exposure/ WASC: 13 – Information Leakage

[zoro1081]

Server Information Disclosure via X-Powered-By HTTP Header/ CWE: 200 – Information Exposure/ WASC: 13 – Information Leakage

Summary

The web server leaks technology information through the X-Powered-By HTTP response header "X-Powered-By: Express"

This allows attackers to identify the underlying web framework in use, which may assist in targeting known vulnerabilities specific to that framework.

While this alone does not allow direct exploitation, it facilitates reconnaissance and may help attackers chain attacks with other vulnerabilities.

HTTP response headers should avoid exposing internal implementation details.

The X-Powered-By header reveals that the site is running Express.js, a Node.js framework. Knowledge of the underlying framework can help attackers:

• Tailor attacks for framework-specific vulnerabilities
• Identify outdated versions or misconfigurations
• Prioritize certain payloads (e.g., Express-specific route exploits)

Affected Asset

URL: https://blog.cerebrum.com/

Proof of Concept

HTTP Request

GET / HTTP/1.1
Host: blog.cerebrum.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: text/html
Cache-Control: no-cache
Pragma: no-cache
Referer: https://www.cerebrum.com/

HTTP Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Powered-By: Express
Cache-Control: public, max-age=0

The X-Powered-By header reveals the framework in use.

Security Impact

• Facilitates reconnaissance for attackers
• Helps in identifying targeted exploits for Express or associated Node.js packages
• Combined with other vulnerabilities, may increase exploitation risk
  This is considered information leakage and violates the principle of least information disclosure.

Root Cause

• Express.js default configuration exposes the X-Powered-By header
• No server or proxy-level suppression applied

Recommendation

Suppress or remove the X-Powered-By header:

Option 1: In Express.js Application
app.disable('x-powered-by');

Option 2: Via Reverse Proxy / Web Server

Nginx: proxy_hide_header X-Powered-By;

Apache: Header unset X-Powered-By

Remove all server/version disclosure headers (e.g., Server) to minimize information leakage.

References

• OWASP: Information Exposure Through Server Headers https://owasp.org/www-community/vulnerabilities/Information_Exposure_Through_Server_Headers
• Express.js Security Best Practices https://expressjs.com/en/advanced/best-practice-security.html
• MDN: X-Powered-By Header https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Powered-By