How to remediate – HTTP TRACE Allowed

1. Introduction

HTTP TRACE Allowed refers to a vulnerability where the HTTP TRACE method remains enabled on a web server. This allows attackers to potentially bypass cookie security flags, leading to session hijacking and Cross-Site Scripting (XSS) attacks. It typically affects default installations of web servers or applications that haven’t been specifically configured to disable this method. A successful exploit could compromise the confidentiality of user sessions.

2. Technical Explanation

The HTTP TRACE method is designed for debugging purposes, allowing a client to send a request and receive it back echoed by the server. However, this functionality can be exploited because it reflects all headers in the response, including cookies. If the HttpOnly flag is set on session cookies, attackers can use TRACE to retrieve them via cross-site scripting (XSS).

• Root cause: The HTTP TRACE method is enabled unnecessarily on a web server or application.
• Exploit mechanism: An attacker sends an HTTP TRACE request to the server. If successful, the response includes all headers sent by the client, potentially revealing session cookies even if they are flagged as HttpOnly. This allows them to steal session tokens and impersonate users.
• Scope: Web servers (e.g., Apache, Nginx, IIS) and applications using HTTP protocols are affected. Default configurations often have TRACE enabled.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking whether the HTTP TRACE method is allowed. Use a quick check with curl or a thorough assessment with a web vulnerability scanner.

• Quick checks: Use the following command to test for an enabled TRACE method:

curl -v -X TRACE http://your-target-url

• Scanning: Nessus, OpenVAS, and Burp Suite can detect HTTP TRACE allowed vulnerabilities. Check their documentation for specific signature IDs.
• Logs and evidence: Examine web server access logs for requests using the TRACE method. Look for responses with a status code of 200 or similar indicating success.

4. Solution / Remediation Steps

Disable the HTTP TRACE method on your web server to prevent potential exploitation. The following steps provide guidance for common configurations.

4.1 Preparation

• Ensure you have access to modify the web server’s configuration file. A roll back plan involves restoring the original configuration file.

4.2 Implementation

1. Step 1: For Apache, edit your virtual host configuration file (e.g., httpd.conf or apache2.conf) and add or modify the following line within the appropriate <Directory> block:

TraceOff

2. Step 2: For Nginx, edit your server configuration file (e.g., nginx.conf) and add or modify the following line within the appropriate server block:

if ($request_method = TRACE) { return 405; }

3. Step 3: For IIS, open the IIS Manager. Navigate to your website and select “HTTP Methods”. Remove the “TRACE” method from the list of allowed methods.
4. Step 4: Restart your web server for the changes to take effect.

4.3 Config or Code Example

Before (Apache – no explicit TraceOff directive)

<Directory /var/www/html>
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

After (Apache – with TraceOff directive)

<Directory /var/www/html>
    Options Indexes FollowSymLinks
    TraceOff
    AllowOverride None
    Require all granted
</Directory>

4.4 Security Practices Relevant to This Vulnerability

• Least privilege: Limit the methods allowed on your web server to only those required for operation, reducing the attack surface.
• Secure headers: Implement security headers like X-Content-Type-Options: nosniff and Strict-Transport-Security to mitigate XSS attacks.
• Patch cadence: Regularly update your web server software with the latest security patches.

4.5 Automation (Optional)

Configuration management tools like Ansible can automate disabling TRACE across multiple servers.

---
- hosts: webservers
  tasks:
    - name: Disable HTTP TRACE in Apache configuration
      lineinfile:
        path: /etc/apache2/apache2.conf
        regexp: '^TraceOff'
        line: TraceOff
        state: present
      notify: Restart Apache
  handlers:
    - name: Restart Apache
      service:
        name: apache2
        state: restarted

5. Verification / Validation

Confirm the fix by retesting with curl and verifying that the TRACE method is no longer allowed. Perform a basic service smoke test to ensure functionality remains intact.

• Post-fix check: Run the following command again. It should return an error (e.g., 405 Method Not Allowed):

curl -v -X TRACE http://your-target-url

• Re-test: Re-run the initial curl test to confirm that the server no longer responds to TRACE requests.
• Smoke test: Verify that standard website functionality (e.g., loading pages, submitting forms) still works as expected.
• Monitoring: Monitor web server logs for any errors related to disallowed HTTP methods.

6. Preventive Measures and Monitoring

Update security baselines and implement checks in your CI/CD pipeline to prevent the re-introduction of this vulnerability. For example, use automated configuration scanning tools.

• Baselines: Update your web server security baseline or policy to explicitly disable the HTTP TRACE method.
• Pipelines: Add a check in your CI/CD pipeline that scans for enabled HTTP TRACE during deployment.
• Asset and patch process: Implement a regular patch review cycle for all web servers.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: In rare cases, legitimate applications might rely on TRACE for specific functionality (uncommon).
• Roll back: Restore the original web server configuration file if any issues arise. Restart the web server to apply the changes.

8. References and Resources

• Vendor advisory or bulletin: N/A – this is a general misconfiguration, not usually covered by specific advisories.
• NVD or CVE entry: http://www.owasp.org/index.php/Cross_Site_Tracing
• Product or platform documentation relevant to the fix: Refer to your web server’s official documentation for instructions on disabling HTTP methods.