在将Spring MVC应用部署到CentOS并配置https/ssl后，使用IBM Rational AppScan扫描发现存在Insecure HTTP Methods漏洞。解决方法是在web.xml中添加安全约束，阻止不安全的HTTP方法。此外，文章提及了对Security-constraint的理解和相关安全防御措施。
今天把Spring MVC的Java网站部署到CentOS上，并且设置了https/ssl 8443端口，然后用IBM Rational AppScan进行安全扫描，发现一个漏洞：Insecure HTTP Methods Enabled. 原因是Tomcat支持的http命令中包含DELETE、OPTIONS、PUT、HEAD和TRACE这五条命令。
漏洞描述和建议：
Insecure HTTP Methods Enabled
Severity: Medium
Type: Infrastructure test
WASC Threat Classification: Client-side Attacks: Content Spoofing
CVE Reference(s): N/A
Security Risk: It is possible to upload, modify or delete web pages, scripts and files on the web server
Fix Recommendation
If you do not need WebDAV enabled on your server, make sure that you either disable it, or disallow HTTP methods (verbs) that are unneeded.
Severity: Medium
Type: Infrastructure test
WASC Threat Classification: Client-side Attacks: Content Spoofing
CVE Reference(s): N/A
Security Risk: It is possible to upload, modify or delete web pages, scripts and files on the web server
Fix Recommendation
If you do not need WebDAV enabled on your server, make sure that you either disable it, or disallow HTTP methods (verbs) that are unneeded.
最低0.47元/天 解锁文章
1万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
