An unsecured HTTP method workaround is enabled for IBM APPSCAN
Security Risks:Web pages, scripts, and files may be uploaded, modified, or deleted on the Web server.
Possible causes:The WEB server or application server is configured in an insecure manner.
Revised recommendations:If the server does not need to support WebDAV, be sure to disable it or disallow unnecessary HTTP methods.
Introduction to the method:In addition to the standard get and post methods, HTTP requests use a variety of other methods. Many of these methods are mainly used to accomplish uncommon and special tasks. If these methods are accessible to low-privileged users, they can then implement effective attacks against the application. Here are some notable ways to do this:
PUT |
Uploading files to a specified directory |
DELETE |
Delete the specified resource |
COPY |
Copies the specified resource to the location specified by the destination message header |
MOVE |
Moves the specified resource to the location specified by the destination message header |
SEARCH |
Search for resources in a directory path |
PROPFIND |
Gets information about the specified resource, such as author, size, and content type |
TRACE |
Returns the original request received by the server in the response |
Several of these methods belong to the HTTP protocol WebDAV (web-based distributed Authoring and Versioning) extension.
penetration test steps:Use the Options method to list the HTTP methods used by the server. Note that the methods that are activated in different directories may vary. Many times, it is advised that some methods are effective, but they are not actually used. Sometimes, even if a method is not listed in the response returned by the options request, the method is still available. Test each method manually to verify that it is available.
To test with Curl:
Curl -v -X OPTIONS http://www.example.com/test/
View the allow:get of the response, HEAD, POST,PUT,DELETE, OPTIONS
Curl -v -T test. HTML http://www.example.com/test/test.html
See if it can be uploaded to determine if the attack takes effect. Find a page that exists, such as test2.html
Curl -X DELETE http://www.example.com/test/test2.html
If the deletion succeeds, the attack is valid.
Solution:such as Tomcat, configure Web. xml
<security-constraint>
<web-resource-collection>
<web-resource-name>Fortune</web-resource-name>
<url-pattern>/*</url-pattern>
PUT
DELETE
HEAD
OPTIONS
TRACE
</web-resource-collection>
Span class= "PLN" > <auth-constraint></auth-constraint>
</security-constraint>
Reboot tomcat to complete. The above code is added to an application and can also be added to the Tomcat Web. XML, the difference being added to an app is only valid for one app, and if added to the Tomcat Web. XML, all the apps under Tomcat are validAn unsecured HTTP method workaround is enabled for IBM APPSCAN