Web Server HTTP TRACE/TRACK Method Support Cross-Site Tracing Vulnerability 

Version 1

    Observation/Risk:

    One web application was identified as having the HTTP TRACE method enabled. This feature is installed to assist developers in debugging web page programming and will not be necessary after servers are in production.

    Servers supporting this method are subject to cross-site tracing (XST) attacks, a variation of cross-site scripting, when used in conjunction with various other browser weaknesses. Although difficult to exploit, an unauthorized user may use this flaw to trick legitimate web users into giving them their credentials.

    For more information on this vulnerability, see:

    http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf

     

    Effects on the Cloud Services Appliance:

    The LANDesk Cloud Services Appliance is not vulnerable to this attack.  TRACE is an http verb that is optional, and the gateway does not implement it.  The gateway implements HEAD, GET, and POST, but not TRACE.