Detections
Analytics

5.7 Ensure HTTP Request Methods Are Restricted - allow

Information

Use the Apache <LimitExcept> directive to restrict unnecessary HTTP request methods of the web server to only accept and process the GET, HEAD, POST and OPTIONS HTTP request methods.

Rationale:

The HTTP 1.1 protocol supports several request methods which are rarely used and potentially high risk. For example, methods such as PUT and DELETE are rarely used and should be disabled in keeping with the primary security principal of minimize features and options. Also since the usage of these methods is typically to modify resources on the web server, they should be explicitly disallowed. For normal web server operation, you will typically need to allow only the GET, HEAD and POST request methods. This will allow for downloading of web pages and submitting information to web forms. The OPTIONS request method will also be allowed as it used to request which HTTP request methods are allowed. Unfortunately, the Apache <LimitExcept> directive does not deny the TRACE request method. The TRACE request method will be disallowed in another benchmark recommendation with the TraceEnable directive.

Solution

Perform the following to implement the recommended state:

Locate the Apache configuration files and included configuration files.

Search for the directive on the document root directory such as:

<Directory "/usr/local/apache2/htdocs">
 . . .
</Directory>

Add a directive as shown below within the group of document root directives.

# Limit HTTP methods to standard methods. Note: Does not limit TRACE
<LimitExcept GET POST OPTIONS>
 Require all denied
</LimitExcept>

Search for other directives in the Apache configuration files other than the OS root directory and add the same directives to each. It is very important to understand that the directives are based on the OS file system hierarchy as accessed by Apache and not the hierarchy of the locations within web site URLs.

<Directory "/usr/local/apache2/cgi-bin">
 . . .
 # Limit HTTP methods
 <LimitExcept GET POST OPTIONS>
 Require all denied
 </LimitExcept>
</Directory>

or use the experimental AllowMethods module

Locate the Apache configuration files and included configuration files.

Search for the directive "AllowMethods" on the document root directory such as:

<Directory "/usr/local/apache2/htdocs">
 . . .
</Directory>

Add a directive as shown below within the group of document root directives.

LoadModule allowmethods_module modules/mod_allowmethods.so
<Directory /var/www>
#other directives
AllowMethods GET POST OPTIONS
</Directory>

4. Search for other directives in the Apache configuration files other than the OS root directory and add the same directives to each. It is very important to understand that the directives are based on the OS file system hierarchy as accessed by Apache and not the hierarchy of the locations within web site URLs.

LoadModule allowmethods_module modules/mod_allowmethods.so
<Directory /var/www>
#other directives
AllowMethods GET POST OPTIONS
</Directory>

Default Value:

No Limits on HTTP methods.

See Also

https://workbench.cisecurity.org/files/4548

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-18, 800-53|SC-23, CSCv7|9.2

Plugin: Unix

Control ID: cfaa6a2ed79d532b366c167004c0d7b6f1f2a621c325fec3bebbd66748f72590