远程WWW服务支持TRACE请求（tomcat漏洞修复及测试方案）

太过爱你忘了你带给我的痛 2023-02-17 01:22 44阅读 0赞

近期主机安全扫描除了安全漏洞，如图

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70][]

看到该问题的第一思路，找到具体端口号对应的应用。主机配置httpd服务信息。最终发现主机上并未开启httpd服务。应用是基于tomcat发布的，并且为springboot的内嵌tomcat。意思就是说跟主机侧无关，需要调整应用侧代码。于是百度

**tomcat传统形式通过配置web.xml达到禁止不安全的http方法**

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> &lt;security-constraint&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;web-resource-collection&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;url-pattern&gt;/*&lt;/url-pattern&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;PUT&lt;/http-method&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&lt;http-method&gt;DELETE&lt;/http-method&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&lt;http-method&gt;HEAD&lt;/http-method&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&lt;http-method&gt;OPTIONS&lt;/http-method&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&lt;http-method&gt;TRACE&lt;/http-method&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/web-resource-collection&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;auth-constraint&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/auth-constraint&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&lt;/security-constraint&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&lt;login-config&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;auth-method&gt;BASIC&lt;/auth-method&gt;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&lt;/login-config&gt; &nbsp; </td> 
 </tr> 
 </tbody> 
</table>

**Spring boot使用内置tomcat，2.0版本以前使用如下形式**

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> @Bean public ConfigurableServletWebServerFactory configurableServletWebServerFactory() { &nbsp;&nbsp;&nbsp;&nbsp;TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory(); &nbsp;&nbsp;&nbsp;&nbsp;factory.addContextCustomizers(context -&gt; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SecurityConstraint securityConstraint = new SecurityConstraint(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;securityConstraint.setUserConstraint("CONFIDENTIAL"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SecurityCollection collection = new SecurityCollection(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addPattern("/*"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("HEAD"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("PUT"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("DELETE"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("OPTIONS"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("TRACE"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("COPY"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("SEARCH"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;collection.addMethod("PROPFIND"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;securityConstraint.addCollection(collection); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;context.addConstraint(securityConstraint); &nbsp;&nbsp;&nbsp;&nbsp;}); &nbsp;&nbsp;&nbsp;&nbsp;return factory; } &nbsp; </td> 
 </tr> 
 </tbody> 
</table>

然后把以上代码放在启动类中，把这个内嵌tomcat的配置用以下代码修改了，重新装配到spring容器。

**测试过程**：做了以上修改并不知道怎么去模拟请求测试。TRACE请求没听说过，网上没有具体测试方法，如果用其他方法测试，最大可能就是报405错误。最终想到的测试方法--反测，既然代码已经支持了POST请求，那么把POST请求也放入到tomcat的禁用请求类型中测试。看看POST请求支持的效果。以下没禁用POST,响应结果正常。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 1][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 2][]

禁用POST后，发现请求已经被拒绝了。就说明该代码配置能达到禁用请求类型的效果。![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 4][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200610162716266.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200610162815178.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200610162825325.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200610162836990.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200610162854241.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mjc0MDU0MA==,size_16,color_FFFFFF,t_70