https://issues.apache.org/bugzilla/show_bug.cgi?id=56332
Bug ID: 56332
Summary: TRACE/TRACK Method Detected
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Windows NT
Status: NEW
Severity: normal
Priority: P2
Component: All
Assignee: [email protected]
Reporter: [email protected]
Certainty
Url http://apache.org/
Vulnerability Details
I have detected the TRACE/TRACK method is allowed.
Impact
It is possible to bypass the HttpOnly cookie limitation and read the cookies in
a cross-site scripting attack by using the TRACE/TRACK method within an
XmlHttpRequest. This is not possible with modern browsers, so the vulnerability
can only be used when targeting users with unpatched and old browsers.
Remedy
Disable this method in all production systems. Even though the application is
not vulnerable to cross-site scripting, a debugging feature such as TRACE/TRACK
should not be required in a production system and therefore should be disabled.
External References
•Cross Site Tracing
•US-CERT VU#867593
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
