Nextcloud image leaks server and PHP version

[cjaone]

The nextcloud image leaks the server and PHP version.

Steps to reproduce on the command line:

1. curl -v https://yourdomain.com

Observed:

< server: Apache/2.4.65 (Debian)
< x-powered-by: PHP/8.3.29

Image used:

• nextcloud:32.0.3

[joshtrichards]

I have no strong feelings either way (at least in theory), but since we have to consider changes in the broader context of the various use cases for the images here:

• Dropping these headers is essentially security through obscurity; attackers can fingerprint the server platform in other ways.
• These images are meant to be base images, for experts (that presumably know their infrastructure requirements and are aware of the trade-offs), and to be customized as needed by operators for their use cases. Some may want this info available; others may not. I have no idea how to determine the % split to assess whether it should be the default.
  • For other images (not in this repo) that aim to be more "turnkey" - such as AIO or LSIO - it certainly may make sense to obscure as default behavior.
• Not having this info visible can make troubleshooting harder.
• It's already quite easy for admins that wish to turn these bits of info off to do so.
• The Apache images here are intended to be used behind a reverse proxy and don't formally support HTTPS on their own. So presumably every admin that wants this change would need to do similar at their TLS layer/reverse proxy layer already (and still would need to do so with this change except for perhaps the PHP header).
• Existing X-Powered-By: behavior is inherited from upstream (PHP) including in their provided php.ini-production
• Existing Server: behavior is inherited from upstream (Apache).

Admittedly would be:

• Consistent with upstream (Nextcloud) recommended Nginx configuration (well, for the Server: header; not for the PHP one):
  • https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html
  • Though it's not documented AFAIK for the Nextcloud Apache and PHP configs
• Consistent with OWASP suggestions though even they have the obscurity caveat:
  • https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server

Related references:

• https://httpd.apache.org/docs/2.4/mod/core.html#servertokens
• https://www.php.net/manual/en/ini.core.php#ini.expose-php
• https://www.php.net/manual/en/security.hiding.php

[J0WI]

Kind of duplicates #612

[pluim003]

I use Zoraxy as reverse proxy manager and managed to get rid of the x-powered-by - message by the following in my config.

curl -v mynextcloud.domain shows also zr-origin-location as http://mynextcloud.domain/login . No big deal I guess as someone could guess that might be the login-landingpage (although I use https).