---
title: "WEB-EXP-006 Web Server Status Page Exposed"
canonical: https://openvapt.com/checks/WEB-EXP-006.html
html: https://openvapt.com/checks/WEB-EXP-006.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-EXP-006 Web Server Status Page Exposed

Checks whether Apache server-status/server-info or nginx stub_status are reachable for each site.

- Domain: Web Apps
- Severity: Medium
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-497
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.3.2
- NIST SP 800-53 Rev. 5: CM-7, SI-11

## Why It Matters

Status pages show live requests (including URLs with tokens), client IPs, virtual hosts and modules.

## How It Detects

Requests /server-status, /server-info and /nginx_status for each site through 127.0.0.1. Because the scan itself comes from 127.0.0.1, a page that answers is checked against the web server configuration: when the status location carries Require local, Require ip 127.0.0.1 or allow 127.0.0.1 with deny all, the page is reachable from this machine only and the check passes with that noted (confirm from another machine); otherwise it fails.

## How to Fix

Restrict to administrators: <Location /server-status> Require local </Location> (Apache), or allow 127.0.0.1; deny all; (nginx). Remove the module if unused.

## How to Verify

```
From another machine: curl -s -o /dev/null -w '%{http_code}' https://<site>/server-status  should print 403 or 404.
```

## Learn the Theory

- [P6 Information Exposure and Misconfiguration](https://openvapt.com/academy/p6.md)

## References

- [Apache HTTP Server, mod_status](https://httpd.apache.org/docs/2.4/mod/mod_status.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go

Run it: `openvapt scan --only WEB-EXP-006`. Read it offline: `openvapt explain WEB-EXP-006`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-EXP-006.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.