Nmap version scan showing webadmin version #893

New Issue

2026-10-05T04:51:12+02:00

adam commented

2026-10-05 04:51:12 +02:00

❯ sudo nmap -sV neptune
Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-16 <redacted>
Nmap scan report for <redacted>
Host is up (0.048s latency).
Not shown: 996 filtered ports
PORT     STATE SERVICE  VERSION
...
<port>/tcp open  http     ZNC IRC webadmin 1.6.6
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .                                                              
Nmap done: 1 IP address (1 host up) scanned in 24.77 seconds

Is it possible to avoid leaking the webadmin version number?

```sh ❯ sudo nmap -sV neptune Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-16 <redacted> Nmap scan report for <redacted> Host is up (0.048s latency). Not shown: 996 filtered ports PORT STATE SERVICE VERSION ... <port>/tcp open http ZNC IRC webadmin 1.6.6 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 24.77 seconds ``` Is it possible to avoid leaking the webadmin version number?

adam commented

2026-10-05 04:51:13 +02:00

There is an option to not show it to unidentified users, but your ZNC is outdated and I am not sure if it's in 1.7.x instead. The latest version seems to be 1.7.1.

There is an option to not show it to unidentified users, but your ZNC is outdated and I am not sure if it's in 1.7.x instead. The latest version seems to be 1.7.1.

adam commented

2026-10-05 04:51:14 +02:00

HideVersion = true in znc.conf (which can e.g. be set through WebAdmin).

However, I think this is still a valid bug report: A bug was introduced in https://github.com/znc/znc/commit/f9a45076690990f75a14315db4f456e750073723#diff-25c2c7eb477d7380781c5cf53f9b0447R99. Before this, I think webadmin never leaked the version number. However, this commit added code like this in CZNC::GetTag():

if (!Get().m_bHideVersion) {
    bIncludeVersion = true;
}

So, if the version is not hidden, then include it "everywhere" (even if the caller of this function did not request it). Worse, if the version should be hidden, this will still include the version number if the caller requested it.
I think this should instead look like this:

if (Get().m_bHideVersion) {
    bIncludeVersion = false;
}

So: If the version should be hidden, do not include it, even if the caller asked for it.

(According to GitHub, the above commit is in znc 1.6.0, so should also be available in your version)

`HideVersion = true` in `znc.conf` (which can e.g. be set through WebAdmin). However, I think this is still a valid bug report: A bug was introduced in https://github.com/znc/znc/commit/f9a45076690990f75a14315db4f456e750073723#diff-25c2c7eb477d7380781c5cf53f9b0447R99. Before this, I think webadmin never leaked the version number. However, this commit added code like this in `CZNC::GetTag()`: ```cpp if (!Get().m_bHideVersion) { bIncludeVersion = true; } ``` So, if the version is not hidden, then include it "everywhere" (even if the caller of this function did not request it). Worse, if the version should be hidden, this will still include the version number if the caller requested it. I think this should instead look like this: ```cpp if (Get().m_bHideVersion) { bIncludeVersion = false; } ``` So: If the version should be hidden, do not include it, even if the caller asked for it. (According to GitHub, the above commit is in znc 1.6.0, so should also be available in your version)

adam commented

2026-10-05 04:51:15 +02:00

@psychon then it would hide the version even from logged in users. E.g. /znc version would not tell you what version it is.

The behavior I implemented follows defaults of other HTTP servers, which is show by default.

@psychon then it would hide the version even from logged in users. E.g. `/znc version` would not tell you what version it is. The behavior I implemented follows defaults of other HTTP servers, which is show by default.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#893