HTTP TRACE method should be disabled. 'TraceEnable'

Information

The HTTP 'TRACE' Method is essentially trace route for Web traffic. It is an application layer loop-back of the request. It will send a HTTP packet to a destination host and then return a packet describing the path, which was travelled. The interesting reconnaissance technique is that the TRACE method will identify intermediate Proxy and Load Balancer Servers that are between the client and the destination host.

Solution

For IBM HTTP Server >= Version 7.0
In IBM HTTP Server 7.0 and later, the 'TraceEnable' directive is provided to disable the TRACE HTTP method.
To disable TRACE, enter the following line in httpd.conf file
TraceEnable off
For IBM HTTP Server < Version 7.0
Uncomment any lines in httpd.conf that contain 'mod_rewrite' like:
LoadModule rewrite_module modules/mod_rewrite.so
AddModule mod_rewrite.c
OR
Edit the httpd.conf file and add the following entries:
RewriteEngine On
RewriteLog /usr/local/apache/logs/rewrite.log
RewriteLogLevel 2
RewriteRule [^a-zA-Z0-9|\.|/|_|-] - [F]
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Windows

Control ID: cf91281a5e28171b04b64c6fbac844d3b7c55410136a217eb68d3efbe8e655b5