漏洞修复之关闭 TRACE and/or TRACK methods

漏洞描述：

The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections.

The web server has the following HTTP methods enabled: TRACE
Impact
An attacker may use this flaw to trick your legitimate web users to give him their credentials.
Solution:
Solution type: Mitigation
Disable the TRACE and TRACK methods in your web server conguration.
Please see the manual of your web server or the references for more information.
Aected Software/OS
Web servers with enabled TRACE and/or TRACK methods.
Vulnerability Insight
It has been shown that web servers supporting this methods are subject to cross-site-scripting
attacks, dubbed XST for Cross-Site-Tracing, when used in conjunction with various weaknesses
in browsers.
Vulnerability Detection Method
Checks if HTTP methods such as TRACE and TRACK are enabled and can be used.
Details: HTTP Debugging Methods (TRACE/TRACK) Enabled
OID:1.3.6.1.4.1.25623.1.0.11213
Version used: 2022-05-12T09:32:01Z
References
cve: CVE-2003-1567
cve: CVE-2004-2320
cve: CVE-2004-2763
cve: CVE-2005-3398
cve: CVE-2006-4683
cve: CVE-2007-3008
cve: CVE-2008-7253
cve: CVE-2009-2823
cve: CVE-2010-0386
cve: CVE-2012-2223
cve: CVE-2014-7883

漏洞解决：根据建议关闭 TRACE and TRACK methods

处理方法：Apache版本大于2.2，在 httpd.conf 末尾添加 TraceEnable off

1、查看Apache版本：httpd -v

[root@ecs-9408 conf]# httpd -v
-bash: httpd: command not found
[root@ecs-9408 conf]# export PATH=/usr/local/apache/bin:$PATH
[root@ecs-9408 conf]# echo $PATH
/usr/local/apache/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
[root@ecs-9408 conf]# httpd -v
Server version: Apache/2.4.54 (Unix)
Server built:   Nov  6 2022 20:58:09

2、编辑 httpd.conf

vi /usr/local/apache/conf/httpd.conf

末尾添加如下内容

TraceEnable off

注：路径或者为/etc/httpd/conf/httpd.conf

3、重启Apache

/usr/local/apache/bin/apachectl restart

4、测试

关闭前

telnet xxx.xxx.xxx.xx 8092
TRACE / HTTP/1.0
X-Test:abcde

结果会返回 200 OK

关闭后测试会返回 405 Method Not Allowed

HTTP/1.1 405 Method Not Allowed
Date: Thu, 08 Dec 2022 02:30:05 GMT
Server: Apache
Allow:
Content-Length: 348
Connection: close
Content-Type: text/html; charset=iso-8859-1