4.6 Ensure 'HTTP Trace Method' is disabled

Information

The HTTP TRACE method returns the contents of client HTTP requests in the entity-body of the TRACE response. Attackers could leverage this behavior to access sensitive information, such as authentication data or cookies, contained in the HTTP headers of the request. One such way to mitigate this is by using the <verbs> element of the <requestFiltering> collection. The <verbs> element replaces the [AllowVerbs] and [DenyVerbs] features in UrlScan. It is recommended the HTTP TRACE method be denied.

Rationale:

Attackers may abuse HTTP TRACE functionality to gain access to information in HTTP headers such as cookies and authentication data. This risk can be mitigated by not allowing the TRACE verb.

Solution

Open Internet Information Services (IIS) Manager

In the Connections pane, select the site, application, or directory to be configured

In the Home pane, double-click Request Filtering

In the Request Filtering pane, click the HTTP verbs tab, and then click Deny Verb... in the Actions pane

In the Deny Verb dialog box, enter the TRACE, and then click OK

To set this Request Filter using an AppCmd.exe command, run the following command at an elevated command prompt:

%systemroot%\system32\inetsrv\appcmd set config /section:requestfiltering /+verbs.[verb='TRACE',allowed='false']

See Also

https://workbench.cisecurity.org/benchmarks/14293

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Windows

Control ID: 91de52b452a77ae510ba20a0d61705e92e47999eaa13e29d86a7799fb0a8dec3