x-backend-server-header-detect: X-Backend-Server Header - Exposure

2025-12-12 x-backend-server-header-detect PoC Public

Description

Detected that the website returned the X-Backend-Server header, which included potentially internal or hidden IP addresses or hostnames. By exposing these values, attackers might have attempted to circumvent security proxies and access these hosts directly.

PoC

id: x-backend-server-header-detect

info:
  name: X-Backend-Server Header - Exposure
  author: pussycat0x
  severity: low
  description: |
    Detected that the website returned the X-Backend-Server header, which included potentially internal or hidden IP addresses or hostnames. By exposing these values, attackers might have attempted to circumvent security proxies and access these hosts directly.
  remediation: disable revealing the X-Backend-Server header value.
  reference:
    - https://docs.gitlab.com/user/application_security/dast/browser/checks/16.4/
    - https://www.zaproxy.org/docs/alerts/10039/
  metadata:
    verified: true
    max-request: 1
    shodan-query: "X-Backend-Server"
  tags: headers,misconfig,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/en"

    matchers:
      - type: word
        part: header
        words:
          - "X-Backend-Server"

    extractors:
      - type: regex
        part: header
        name: hostname
        group: 1
        regex:
          - 'X-Backend-Server: ([A-Za-z0-9.-]+)'
# digest: 4a0a0047304502210085aec261623a4c7c8cbb73cf739b3f9ff1d25058783dfdfae146b9c7583bd477022024c10e372b8a588b56c142d5ec09901fab83c30165d33f17c019e40c19f96b82:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/x-backend-server-header-detect.yaml

References

Related Vulnerabilities