CRZ-003

Default nginx welcome page on production ALB

low CVSS 3.1: 5.3 · Asset: widget.simulator.company

Summary

widget.simulator.company is live on HTTPS with a valid Let's-Encrypt-equivalent cert but serves the default nginx welcome page — an "unfinished server" indicator. The hostname is behind a production-shaped ALB (mw-prod-control-1-id160-public-*.elb.eu-west-1.amazonaws.com), so this is not just a dev/scratch host.

Reproduction

$ curl -sk https://widget.simulator.company/ | head -5
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>

Impact

  1. Attack surface without business value. A live host on a production ALB that does nothing but serve default content is pure attack surface with zero user value — every CVE in nginx, every misconfiguration in the underlying workload, applies.
  2. Branding / trust signal. If a customer stumbles onto it, the default nginx page signals sloppy ops.
  3. Possible virtual host routing bug. The ALB routes widget.simulator.company to a pod that doesn't have a matching server block — investigate whether some other hostname is supposed to be routed here.

Remediation

  1. If widget.simulator.company is not used, remove the DNS record and the ALB listener rule.
  2. If it IS used, fix the nginx/Ingress config so the correct app is served.
  3. Audit all ALB listener rules for hostnames that match default backends instead of real services.

References