Disable Trace/Track in Apache HTTPD

Introduction

Disabling TRACE and TRACK in Apache for PCI-related vulnerabilities like Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability is surprisingly easy with the Apache web server. The main thing to keep in mind is understanding that if you are running apache and this vulnerability pops up during a scan, you can be reasonably certain that TRACK is not the problem TRACE is.

The HTTP TRACK method is something Microsoft cooked up that performs essentially the same thing that TRACE does with the exception that it never got used—except by penetration testers, hackers, worms, and vulnerability scanners.
Validation Steps

If you web server is listening on port 80, by far the easiest (and universal) way to determine whether it is vulnerable or not is using telnet. Simply open up your telnet application and connect to your web site/web server over port 80, ( telnet). If you are using the Microsoft telnet client, be careful because it doesn’t echo back what you were typing in. Once you connect, type the following:

TRACE / HTTP/1.0
Host: <hostname_you_are_testing>
VAR1: Test
VAR2: Test2
VAR3: Test3

Press enter twice and if trace is enabled, if you are not using rewrite rules you should see output similar to the following:

HTTP/1.1 200 OK
Server: Apache
Date: Fri, 30 Sep 2011 03:15:30 GMT
Content-Type: message/http
Content-Length: 76

TRACE / HTTP/1.0
Host: <hostname_you_are_testing>
VAR1: Test
VAR2: Test2
VAR3: Test3

If you are using rewrite rules you should see output similar to the following:

HTTP/1.1 301 Moved Permanently
Date: Fri, 30 Sep 2011 03:15:30 GMT
Server: Apache
Location: http://<hostname_you_are_testing>405.shtml
Content-Length: 243
Connection: close
Content-Type: text/html; charset=iso-8859-1

DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”>
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href=”http://<hostname_you_are_testing>405.shtml”>here</a>.</p>
</body></html>

Request and Response over telnet for the HTTP TRACK method is same, for testing purposes, as it is for TRACE. Simply substitute TRACK for TRACE. If you need to test a host that is listening on ssl port 443 (and does not have an HTTP port exposed), use openssl’s s_client. Simply type ” openssl s_client -connect”. You will connect and then you can enter the above request the same as you would for telnet.

TRACE is enabled by default in an apache installation. There are two ways to remediate. The first can be used if you are running Apache 1.3.34, 2.0.55, or anything in the 2.2 release. Simply add the TraceEnable directive into your httpd.conf and set the value to Off.

The second mechanism involves creating a mod_rewrite rule that will disable http methods, which is also quite popular and works with ANY version of apache that supports mod_rewrite. The directives below would need to be set, which are written assuming that this is the first time use for mod_rewrite.

The first thing to do is make sure that mod_rewrite is loaded. If mod_rewrite.so is missing from your apache configuration but you have it installed, (and your install location is /usr/local/apache), then add the following statement to your httpd.conf:

LoadModule rewrite_module “/usr/local/apache/modules/mod_rewrite.so”

Then add the following as well to your httpd.conf file:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* – [F]

Restart apache, re-run the steps in the Validation section, and with either method, you should receive an HTTP 403-Forbidden code back.

As following:

HTTP/1.1 403 Forbidden
Date: Fri, 30 Sep 2011 03:23:47 GMT
Server: Apache
Content-Length: 202
Connection: close
Content-Type: text/html; charset=iso-8859-1

DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”>
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>

You don’t have permission to access /
on this server.</p>
</body></html>

Congratulation you have now disabled TRACE/TRACK method 🙂

Be the first to comment

Leave a Reply

Your email address will not be published.


*


CommentLuv badge