HTTP TRACE vulnerability discovered - what should I do

Question

First, why is HTTP TRACE method allowed on a website Isn't it a bad thing for web server or its users' security?

Second, when I run the following PHP script via my browser...

<?php

$service_port = getservbyname('www', 'tcp');

$host='vulnerabledomain.org';

$address = gethostbyname($host);

$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);

if ($socket < 0) echo "socket_create() failed: reason: " . socket_strerror($socket) . "\n";

$result = socket_connect($socket, $address, $service_port);

if ($result < 0) echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n";

$in = "TRACE /t.php HTTP/1.1\r\n";
$in .= "Cookie: x=str<script>alert(\"XSS\");</script>str\r\n";
$in .= "Host: $host\r\n";
$in .= "Connection: Close\r\n\r\n";

$out = '';

socket_write($socket, $in, strlen($in));

while ($out = socket_read($socket, 2048)) {
    echo $out;
}

socket_close($socket);

?>

...I get a javascript alert window with my message (XSS) that is in the request cookie header, and some other headers/info are displayed within the browser window. Isn't this the sign of a particular vulnerability with this website? I mean things such as XSS, XST, etc. vulnerabilities.

Answer 1

The alert box is displayed because your PHP script is using ...

echo $out;

... without escaping $out. The JavaScript is executed on your domain. Whether the PHP script connects to another server, or just writes the unescaped script tag directly, does make no difference.

---

In order to exploit a TRACE vulnerability, you need to trick the browser to send a TRACE request, for example via JavaScript, Flash, Active X.

The common motivation to exploit TRACE is to read information from the request header that is otherwise unavailable (such as httpOnly cookies and authentication headers):

var request = new ActiveXObject(“Microsoft.XMLHTTP”);
request.open("TRACE", "http://example.com", false);
request.send();
alert(request.responseText);

Answer 2

HTTP Trace is a debugging tool which can be used for malicious use but it does not indicate the presence or lack of XSS or XST, which may or may not be present through other vulnerabilities.

Additionally, if you run code like that on a domain you do not have permissions, you may fall foul of legislation such as the Computer Misuse Act in the UK and may be tried in a criminal court.

My advice would be not to try this on any real website you do not own - see other questions on Security Stack Exchange on running your own vulnerable test servers if you need to find out more.