Vulnerability Note VU#867593
Web servers enable HTTP TRACE method by default
The HTTP TRACE method returns the contents of client HTTP requests in the entity-body of the TRACE response. Attackers could leverage this behavior to access sensitive information, such as cookies or authentication data, contained in the HTTP headers of the request.
The HTTP TRACE method asks a web server to echo the contents of the request back to the client for debugging purposes. The HTTP TRACE method is described in the HTTP 1.1 standard (RFC 2616, section 9.8):
9.8 TRACE The TRACE method is used to invoke a remote, application-layer loop- back of the request message. The final recipient of the request SHOULD reflect the message received back to the client as the entity-body of a 200 (OK) response. ... If the request is valid, the response SHOULD contain the entire request message in the entity-body, with a Content-Type of "message/http". Responses to this method MUST NOT be cached.
As defined above, the complete request, including HTTP headers, is returned in the entity-body of a TRACE response. Using features that provide client-side HTTP protocol support, such as XMLHTTP ActiveX or XMLDOM scripting objects, a web site can cause browsers to issue TRACE requests. The site can read the TRACE response, including sensitive header information such as cookies or authentication data.
Attackers may abuse HTTP TRACE functionality to gain access to information in HTTP headers such as cookies and authentication data. In the presence of other cross-domain vulnerabilities in web browsers, sensitive header information could be read from any domains that support the HTTP TRACE method.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Apache||Affected||08 Jan 2003||10 Jan 2003|
|IBM Corporation||Affected||-||22 Feb 2008|
|Lotus Software||Affected||-||22 Feb 2008|
|Microsoft Corporation||Affected||08 Jan 2003||23 Jan 2003|
|Sun Microsystems, Inc.||Affected||08 Jan 2003||17 Aug 2009|
|BEA Systems Inc.||Unknown||-||24 Feb 2003|
|Oracle Corporation||Unknown||-||24 Feb 2003|
|Roxen Internet Software AB||Unknown||-||24 Feb 2003|
|thttpd||Unknown||-||24 Feb 2003|
CVSS Metrics (Learn More)
This issue was researched and reported by Jeremiah Grossman of WhiteHat Security .
This document was written by Art Manion.
- CVE IDs: Unknown
- Date Public: 20 Jan 2003
- Date First Published: 23 Jan 2003
- Date Last Updated: 17 Aug 2009
- Severity Metric: 3.71
- Document Revision: 48
If you have feedback, comments, or additional information about this vulnerability, please send us email.