Description

1, HTTP Trace Method is denied by default and there is noway to enable it.

2, HTTP Track Method is not supported at all.

Symptoms


The firewall has a web server on it for web based management. The TRACE and TRACK methods should be disabled or disallowed on all externally facing web servers.

As per the full risk detail:

"The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for ""Cross-Site-Tracing"", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. CVE : CVE-2004-2320, CVE-2003-1567".

Solution


JWEB uses AppWeb as a web server.

HTTP TRACE method is denied by default on AppWeb. There is no way to enable it through J-Web/CLI.

So when a trace request is made to the server it replies that "The TRACE method is disabled on this server".

root@e48p1-nmsft> telnet 10.204.97.5 port 80
Trying 10.204.97.5...
Connected to 10.204.97.5.
Escape character is '^]'.
TRACE / HTTP/1.1

HTTP/1.1 406 Not Acceptable
Date: Tue, 17 Apr 2012 03:12:21 GMT
Server: Embedthis-Appweb/3.2.3
Cache-Control: max-age=5184000
Expires: Fri, 27 Apr 2012 10:09:35 GMT
Content-Length: 152
Content-Type: text/html
Connection: keep-alive
Keep-Alive: timeout=120, max=199

HTTP TRACK method is an alias of TRACE and is supported only in MS IIS. AppWeb doesn’t support TRACK method at all.