Description
The HTTP TRACE method allows clients to view the entire request received by the web server, primarily for testing and diagnostic purposes. However, enabling this feature can lead to the disclosure of sensitive information such as cookies and authorization tokens to unauthorized clients, facilitating Cross-Site Tracing (XST) attacks.
Recommendation
Enhance security by disabling the TRACE method in the web server configuration. For Apache web servers, add TraceEnable off to the main configuration file.
For Microsoft IIS, access IIS Manager, navigate to Request Filtering, and modify the configuration for TRACK and TRACE verbs in HTTP Verbs.
References
Could your website be exposed too?
SmartScanner can check your website for TRACE Method Allowed and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TRACK Method Allowed - Vulnerability
- Apache Version Disclosure - Vulnerability
- Nginx Version Disclosure - Vulnerability
- No Redirection from HTTP to HTTPS - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024