How to hide vaadinVersion frim response

adnan.khan · July 22, 2024, 8:33am

Hi,

Below Vaadin version is getting displayed in response is it possible we can hide version details.

Observation : Technology disclosure allows attackers to gain insights into the technologies and software used in the
application, potentially aiding them in crafting targeted attacks or exploiting specific software
vulnerabilities.
VAADIN applications might expose version information in various ways, such as in HTTP headers,
meta tags, or response content. Attackers can use this information to identify known vulnerabilities
and exploit them

vaadin.initApplication("ROOT-2521314",{
    "theme": "mcollectBase",
    "versionInfo": {
        "vaadinVersion": "8.14.3-1-jmix",
        "atmosphereVersion": "2.4.30-1-cuba"
    },

p.aleksandrov · July 22, 2024, 1:29pm

Hi, Adnan!

The same behavior you can reproduce on native Vaadin. So we can’t influence on it. There is an article with comments from Vaadin Team that describes reasons of such decision.

github.com/vaadin/framework

Remove Vaadin version mentions in the webapp client side

opened 01:16PM - 31 May 18 UTC

closed 11:36AM - 21 Dec 19 UTC

ghost

question

This ticket is a revamp of #8330 as per `stale bot` request. - **Vaadin Frame…work version** 8.4.2 and 7.7.13 (we use both in ifferent projects) - **Browser version** Google Chrome 67.0.3396.62 64 bit - **Web container name and version** Apache tomcat 8.5.31, Java 1.8.172 - **Description of the bug** From a security standpoint, making it easy for an attacker to know the usage of specific frameworks within a web application (Vaadin and Atmosphere specifically, but also the themes) and furthermore knowing their version, is without any doubts wrong. While using Vaadin, even if the `productionMode` parameter is set to `true`, the client side code is full of Vaadin references also specifying its version. I am not naive, I know that there are still ways to fingerprint the application and to understand which version or version might use, but is far more complicated than reading the web page source code. - **Minimal reproducible example** Open browser, digit the URL of a running web application and open it. Open the browser console (`F12` in Chrome), click on the Elements tab, press `CTRL+F` and search for the query string `v=`. - **Expected behavior** Best case scenario, no reference to Vaadin, Atmosphere and any other framework/theme or versions of any kind. Acceptable scenario, no references to the software versions used. - **Actual behavior** It shows a lot of information that could help an attacker and which should be irrelevant for the correct execution of the application (at least client side).

Also there is an article that seems like to be containing an partial solving of problem with appearing Vaadin version in HTML page source code.