After reding Cross Site Tracing, I scanned one of our sites with the FOCA tool. This came back with several pages/files on our site with the message Insecure methods found (trace) on ...:
This has left me confused, however, because we use Cloudflare and I thought TRACE was disabled. Indeed, when I try with curl:
[user@host ~]# curl -v -X TRACE http://www.domain.tld
* About to connect() to www.domain.tld port 80 (#0)
* Trying 12.34.56.78... connected
* Connected to www.domain.tld (12.34.56.78) port 80 (#0)
> TRACE / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: www.domain.tld
> Accept: */*
>
< HTTP/1.1 405 Not Allowed
< Date: Tue, 14 Feb 2017 12:21:55 GMT
< Content-Type: text/html
< Content-Length: 177
< Connection: close
< Server: -nginx
< CF-RAY: -
<
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>cloudflare-nginx</center>
</body>
</html>
* Closing connection #0
[user@host ~]# curl -v -X TRACE https://www.domain.tld
* About to connect() to www.domain.tld port 443 (#0)
* Trying 12.34.56.78... connected
* Connected to www.domain.tld (12.34.56.78) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: CN=ssl376438.cloudflaressl.com,OU=PositiveSSL Multi-Domain,OU=Domain Control Validated
* start date: Jan 08 00:00:00 2017 GMT
* expire date: Jul 16 23:59:59 2017 GMT
* common name: ssl376438.cloudflaressl.com
* issuer: CN=COMODO ECC Domain Validation Secure Server CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
> TRACE / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: www.domain.tld
> Accept: */*
>
< HTTP/1.1 405 Not Allowed
< Server: cloudflare-nginx
< Date: Tue, 14 Feb 2017 12:22:06 GMT
< Content-Type: text/html
< Content-Length: 177
< Connection: close
< CF-RAY: -
<
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>cloudflare-nginx</center>
</body>
</html>
* Closing connection #0
I've tried the above for all the URLs in the report, on both HTTP/HTTPS, but I always get the same 405 (expected) error.
Why would FOCA report the trace vulnerabilities?
Update: When I query for OPTIONS I only seem to get the standard response back, as if it were a get. I've tried in a few different ways (curl, netcat, nmap) but this is what is returned:
[user@host ~]# curl -X OPTIONS -s -D - www.domain.tld -o /dev/null
HTTP/1.1 200 OK
Date: Wed, 15 Feb 2017 09:48:45 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d4f940f3903e1c8ea83cc23653023dde41487152125; expires=Thu, 15-Feb-18 09:48:45 GMT; path=/; domain=.domain.tld; HttpOnly
X-Powered-By: PHP/7.0.15
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: PHPSESSID=jakcc66bq3s3cta6e3q9vfj7j5; expires=Sat, 18-Feb-2017 09:48:45 GMT; Max-Age=259200; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Set-Cookie: SERVERID=WEB1; path=/
Server: cloudflare-nginx
CF-RAY: 3322d890c7260cb9-LHR
[user@host ~]# nmap -p 80 --script http-methods www.domain.tld
Starting Nmap 5.51 ( http://nmap.org ) at 2017-02-15 11:17 GMT
Nmap scan report for www.domain.tld (104.25.161.34)
Host is up (0.016s latency).
Other addresses for www.domain.tld (not scanned): 104.25.160.34
PORT STATE SERVICE
80/tcp open http
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
Nmap done: 1 IP address (1 host up) scanned in 11.21 seconds
