Status Page Exposed

Gixy Check ID: status_page_exposed

The stub_status module exposes NGINX server metrics including active connections, requests handled, and connection states. Without proper IP restrictions, this information is accessible to anyone and can aid attackers in reconnaissance.

Bad Example

location /status {
    stub_status;
}

Or with allow but missing deny all:

location /status {
    stub_status;
    allow 10.0.0.0/8;
}

Catch this before it reaches production

GetPageSpeed Amplify runs Gixy on a schedule across every NGINX host and alerts you on new findings and CVEs, alongside runtime metrics. Set up continuous monitoring.

Good Example

location = /nginx-status {
    stub_status on;
    allow 127.0.0.1;
    allow ::1;
    deny all;
}

Always pair stub_status with explicit allow directives for trusted IPs and a deny all to block everyone else.