AppScan Fix Vulnerability: Enable unsafe HTTP methods

Recently, for the system to use AppScan scan out of the vulnerability "Enable unsafe HTTP method, found a lot of repair methods can not achieve the effect."

Loopholes:

Vulnerability Description:

Hazard level		In danger
Impact page		The entire Web page.
Short description		An administrator's negligence in server security configuration has led to an unsecured HTTP method being enabled on the server.
Detailed description		Unsafe HTTP methods are primarily Put/delete/move/copy/trace, which can be used to upload files to the server or to delete files on the server through such extension methods.
Patching recommendations		Suppresses unnecessary HTTP methods (verb trace).
Presence Page		Whole station

Fix recommended Scenario:

1. Disable WebDAV features (IIS)

2. using URLScan Disabling options and Other HTTP Method

To perform the steps:

IIS disables the WebDev feature in the extended feature, which disables dangerous actions such as delete-search-copy-move-propfind-proppatch-mkcol-lock-unlock-put.

Installing the URLScan tool :http://www.iis.net/downloads/microsoft/urlscan

After the installation is complete, the configuration file is in the path:

C:\WINDOWS\system32\inetsrv\urlscan\UrlScan.ini

Primary node configuration:

[Options]

Useallowverbs=0 //Disable mode

[AllowVerbs] //Disable certain dangerous requests

DELETE
SEARCH
COPY
MOVE
PROPFIND
PROPPATCH
Mkcol
LOCK
UNLOCK
PUT
TRACE

The access path in the above configuration contains Chinese characters that are abnormal. need To Modify a node:

Allowhighbitcharacters=1

Description: This option is set to 0. If this option is set to 0, URLScan rejects any requests that contain non-ASCII characters. This prevents certain types of attacks, but may also prohibit requests for certain legitimate files, such as files with non-English names.

Configuration file modification is complete, restart IIS after saving, enter in cmd command: iisreset

Reboot complete, test:

Using the Firefox plugin poster, select options, visit the website and see the open page exception. This fix is complete.

This article is provided to the students who are still under the AppScan Scan vulnerability and cannot find a fix.

AppScan Fix Vulnerability: Enable unsafe HTTP methods