2

After reding Cross Site Tracing, I scanned one of our sites with the FOCA tool. This came back with several pages/files on our site with the message Insecure methods found (trace) on ...:

FOCA results

This has left me confused, however, because we use Cloudflare and I thought TRACE was disabled. Indeed, when I try with curl:

[user@host ~]# curl -v -X TRACE http://www.domain.tld
* About to connect() to www.domain.tld port 80 (#0)
*   Trying 12.34.56.78... connected
* Connected to www.domain.tld (12.34.56.78) port 80 (#0)
> TRACE / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: www.domain.tld
> Accept: */*
>
< HTTP/1.1 405 Not Allowed
< Date: Tue, 14 Feb 2017 12:21:55 GMT
< Content-Type: text/html
< Content-Length: 177
< Connection: close
< Server: -nginx
< CF-RAY: -
<
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>cloudflare-nginx</center>
</body>
</html>
* Closing connection #0
[user@host ~]# curl -v -X TRACE https://www.domain.tld
* About to connect() to www.domain.tld port 443 (#0)
*   Trying 12.34.56.78... connected
* Connected to www.domain.tld (12.34.56.78) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=ssl376438.cloudflaressl.com,OU=PositiveSSL Multi-Domain,OU=Domain Control Validated
*       start date: Jan 08 00:00:00 2017 GMT
*       expire date: Jul 16 23:59:59 2017 GMT
*       common name: ssl376438.cloudflaressl.com
*       issuer: CN=COMODO ECC Domain Validation Secure Server CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
> TRACE / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: www.domain.tld
> Accept: */*
>
< HTTP/1.1 405 Not Allowed
< Server: cloudflare-nginx
< Date: Tue, 14 Feb 2017 12:22:06 GMT
< Content-Type: text/html
< Content-Length: 177
< Connection: close
< CF-RAY: -
<
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>cloudflare-nginx</center>
</body>
</html>
* Closing connection #0

I've tried the above for all the URLs in the report, on both HTTP/HTTPS, but I always get the same 405 (expected) error.

Why would FOCA report the trace vulnerabilities?

Update: When I query for OPTIONS I only seem to get the standard response back, as if it were a get. I've tried in a few different ways (curl, netcat, nmap) but this is what is returned:

[user@host ~]# curl -X OPTIONS -s -D - www.domain.tld -o /dev/null
HTTP/1.1 200 OK
Date: Wed, 15 Feb 2017 09:48:45 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d4f940f3903e1c8ea83cc23653023dde41487152125; expires=Thu, 15-Feb-18 09:48:45 GMT; path=/; domain=.domain.tld; HttpOnly
X-Powered-By: PHP/7.0.15
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: PHPSESSID=jakcc66bq3s3cta6e3q9vfj7j5; expires=Sat, 18-Feb-2017 09:48:45 GMT; Max-Age=259200; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Set-Cookie: SERVERID=WEB1; path=/
Server: cloudflare-nginx
CF-RAY: 3322d890c7260cb9-LHR

[user@host ~]# nmap -p 80 --script http-methods www.domain.tld

Starting Nmap 5.51 ( http://nmap.org ) at 2017-02-15 11:17 GMT
Nmap scan report for www.domain.tld (104.25.161.34)
Host is up (0.016s latency).
Other addresses for www.domain.tld (not scanned): 104.25.160.34
PORT   STATE SERVICE
80/tcp open  http
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)

Nmap done: 1 IP address (1 host up) scanned in 11.21 seconds
1

It's most likely that OPTIONS method is configured to return TRACE, but TRACE method is actually not supported on the web server. Many automated scanners like Nessus send an OPTIONS request and confirm that servers support all those http methods, that's why they return false positive results on this matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.