Hi,

As part of our compliance we have carried out a penetration test including a service deployed on railway (love railway btw!).

The scan found the following low-risk items relating to TCP Timestamp info disclosure, is it possible to configure railway to mitigate this?

---

EXTERNAL IP VULNERABILITY ANALYSIS LOW

Attackers continuously scan the internet for exposed services and known vulnerabilities. An

unauthenticated scan of the IP addresses associated with xxx Ltd returned the findings below.

Our team did not attempt exploitation to confirm the attack chain, but each result should be reviewed

and remediated based on its severity and exposure.

Recommendation

Apply TCP timestamp disabling at the OS level for the origin server (XXXX). Block ICMP

timestamp messages at the perimeter firewall. For Cloudflare-fronted IPs, these findings may be at the

CDN edge layer and can be reviewed with Cloudflare support.

IP ADDRESS FINDING SEVERITY CVSS

XXX TCP Timestamps Information Disclosure Low 2.6

XXX TCP Timestamps Information Disclosure Low 2.6

XXX TCP Timestamps Information Disclosure Low 2.6

XXX ICMP Timestamp Reply Information Disclosure Low 2.1

TCP Timestamps Information Disclosure [Low] CVSS: 2.6

INSIGHT

The remote hosts implement TCP timestamps as defined by RFC 1323/RFC 7323. A side effect of this feature is

that the system uptime can sometimes be calculated from the monotonically increasing timestamp values

returned in TCP responses.

IMPACT

Uptime information provides an attacker with intelligence on patching cadence and server availability. This is a

low-severity information disclosure finding with no direct exploitability.

DISCOVERY PROCESS

Specially crafted IP packets were sent with controlled delays between them. Responses were inspected for TCP

timestamp option values. Uptime was computed from the gradient of timestamp values over time.