漏洞修复之关闭 TRACE and/or TRACK methods

小灰灰 2023-09-25 14:01 19阅读 0赞

漏洞描述：

The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections.

The web server has the following HTTP methods enabled: TRACE
    Impact
    An attacker may use this flaw to trick your legitimate web users to give him their credentials.
    Solution:
    Solution type: Mitigation
    Disable the TRACE and TRACK methods in your web server conguration.
    Please see the manual of your web server or the references for more information.
    Aected Software/OS
    Web servers with enabled TRACE and/or TRACK methods.
    Vulnerability Insight
    It has been shown that web servers supporting this methods are subject to cross-site-scripting
    attacks, dubbed XST for Cross-Site-Tracing, when used in conjunction with various weaknesses
    in browsers.
    Vulnerability Detection Method
    Checks if HTTP methods such as TRACE and TRACK are enabled and can be used.
    Details: HTTP Debugging Methods (TRACE/TRACK) Enabled
    OID:1.3.6.1.4.1.25623.1.0.11213
    Version used: 2022-05-12T09:32:01Z
    References
    cve: CVE-2003-1567
    cve: CVE-2004-2320
    cve: CVE-2004-2763
    cve: CVE-2005-3398
    cve: CVE-2006-4683
    cve: CVE-2007-3008
    cve: CVE-2008-7253
    cve: CVE-2009-2823
    cve: CVE-2010-0386
    cve: CVE-2012-2223
    cve: CVE-2014-7883

漏洞解决：根据建议关闭 TRACE and TRACK methods

处理方法：Apache版本大于2.2，在 httpd.conf 末尾添加 TraceEnable off

1、查看Apache版本：httpd -v

[root@ecs-9408 conf]# httpd -v
    -bash: httpd: command not found
    [root@ecs-9408 conf]# export PATH=/usr/local/apache/bin:$PATH
    [root@ecs-9408 conf]# echo $PATH
    /usr/local/apache/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
    [root@ecs-9408 conf]# httpd -v
    Server version: Apache/2.4.54 (Unix)
    Server built:   Nov  6 2022 20:58:09

2、编辑 httpd.conf

vi /usr/local/apache/conf/httpd.conf

末尾添加如下内容

TraceEnable off

> 注：路径或者为/etc/httpd/conf/httpd.conf

3、重启Apache

/usr/local/apache/bin/apachectl restart

4、测试

关闭前

telnet xxx.xxx.xxx.xx 8092
    TRACE / HTTP/1.0
    X-Test:abcde

结果会返回 200 OK

关闭后测试会返回 405 Method Not Allowed

HTTP/1.1 405 Method Not Allowed
    Date: Thu, 08 Dec 2022 02:30:05 GMT
    Server: Apache
    Allow:
    Content-Length: 348
    Connection: close
    Content-Type: text/html; charset=iso-8859-1