解決安全掃描Insecure HTTP Methods Enabled的問題

今天把Spring MVC的Java網站部署到CentOS上，並且設定了https/ssl 8443連接埠，然後用IBM Rational AppScan進行安全掃描，發現一個漏洞：Insecure HTTP Methods Enabled. 原因是Tomcat支援的http命令中包含DELETE、OPTIONS、PUT、HEAD和TRACE這五條命令。

 

 漏洞描述和建議：

Insecure HTTP Methods Enabled

Severity:  Medium
Type: Infrastructure test
WASC Threat Classification: Client-side Attacks: Content Spoofing
CVE Reference(s): N/A
Security Risk: It is possible to upload, modify or delete web pages, scripts and files on the web server

Fix Recommendation
If you do not need WebDAV enabled on your server, make sure that you either disable it, or disallow HTTP methods (verbs) that are unneeded.

 

解決辦法

參考了這個文章，但小題大做了，只需修改網站的web.xml添加下面的內容即可。

<security-constraint>
     <web-resource-collection>
          <web-resource-name>DisableUnsecureHttpActions</web-resource-name>
          <url-pattern>/*</url-pattern>
          <http-method>DELETE</http-method>
          <http-method>PUT</http-method>
          <http-method>HEAD</http-method>
          <http-method>TRACE</http-method>
          <http-method>OPTIONS</http-method>
     </web-resource-collection>
     <auth-constraint>
        <role-name>NotExistingRole</role-name>
     </auth-constraint>
     <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
     </user-data-constraint>
 </security-constraint>

有關Security-constraint的理解，可以參考這個文章。

作者的其它相關文章

• Spring MVC防禦CSRF、XSS和SQL注入攻擊
• Tomcat的SessionID引起的Session Fixation和Session Hijacking問題