Disclosure of version information, usually overlooked by developers but disclosed by default by the systems and frameworks in use, can pose a significant security risk depending on the production environement.

Once this information is public, attackers can use it to identify potential security holes or vulnerabilities specific to that version.

Furthermore, if the published version information indicates the use of outdated or unsupported software, it becomes easier for attackers to exploit known vulnerabilities. They can search for published vulnerabilities related to that version and launch attacks that specifically target those vulnerabilities.

## Ask Yourself Whether

- Version information is accessible to end users.
- Internal systems do not benefit from timely patch management workflows.

There is a risk if you answered yes to any of these questions.

## Recommended Secure Coding Practices

In general, it is recommended to keep internal technical information within internal systems to control what attackers know about the underlying architectures. This is known as the "need to know" principle.

The most effective solution is to remove version information disclosure from what end users can see, such as the "x-powered-by" header.
This can be achieved directly through the web application code, server (nginx, apache) or firewalls.

Disabling the server signature provides additional protection by reducing the amount of information available to attackers. Note, however, that this does not provide as much protection as regular updates and patches.
Security by obscurity is the least foolproof solution of all. It should never be the only defense mechanism and should always be combined with other security measures.

## Sensitive Code Example

    @GetMapping(value = "/example")
    public ResponseEntity<String> example() {
      HttpHeaders responseHeaders = new HttpHeaders();
      responseHeaders.set("x-powered-by", "myproduct"); // Sensitive

      return new ResponseEntity<String>(
          "example",
          responseHeaders,
          HttpStatus.CREATED);
    }

## Compliant Solution

Do not disclose version information unless necessary. The `x-powered-by` or `Server` HTTP headers should not be used.

## See

- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- OWASP Testing Guide - OTG-INFO-008 - Fingerprint Web Application Framework
- OWASP - Top 10 2017 Category A6 - Security Misconfiguration
- CWE - CWE-200 - Information Exposure