1

I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already.

Information Disclosure (inodes)

This article titled: "Vulnerabilities that aren’t. ETag headers" from https://www.pentestpartners.com/security-blog/vulnerabilities-that-arent-etag-headers/ refers to two historical exploits CVE-2003-0105 and CVE-2003-1418 as well as two scanner tools that report about ETags:

  • Nikto: "+ Server may leak inodes via ETags, header found with file /, inode: 591024, size: 101, mtime: Thu Jan 6 11:13:49 2022. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418"
  • Nessus: "The remote web server is affected by an information disclosure vulnerability due to the ETag header providing sensitive information that could aid an attacker, such as the inode number of requested files."

It then continues describing:

An example of an Apache httpd ETag, showing all fields can be seen below:

ETag from Apache httpd

Let’s convert those hex digits to numbers:

inode:  591024
Size:   101 bytes
mtime:  Thu Jan 06 2022 11:13:49

Checking those numbers against the file shows they match: Example of matching numbers

The inode (Index Node), is where this information could cause a security vulnerability.

Privacy Concerns (cookie-less tracking)

This article titles: "tracking without cookies" from http://www.arctic.org/~dean/tracking-without-cookies.html describes the possibility of cookie-less tracking through the use of ETags, with its related privacy concerns.

Questions

  • Are inodes the only type of known information disclosure through ETags or are there other examples of information disclosure through ETags?
  • What are (other) security or privacy related risks associated with the use of the HTTP 'ETag' header?
  • Should the use of ETags be entirely avoided for security and privacy concerns as a result of those risks?

Other

Related from a performance perspective: https://cloudfour.com/thinks/should-i-remove-etags-from-my-headers/#rational-for-removing-etags.

1
  • 2
    Two CVEs related to a tech do not bring the whole tech into disrepute, especially when they are 20 years old. Tracking without cookies is possible with various tech (HSTS is another example). I'm not sure about the current state of counter-measures in browsers, but if you're looking to go deep on this topic, that's probably a good place to start.
    – paj28
    Oct 31, 2023 at 17:35

1 Answer 1

5

Are inodes the only type of known information disclosure through ETags or are there other examples of information disclosure through ETags?

The purpose of Etag is to detect if a file has changed and thus need to be resent by the server or if the existing cached copy in the client can be still used.

A common implementation to achieve this is just use the hash of the file as Etag. But while this might be considered an information disclosure it is unlikely to be relevant.

What are (other) security or privacy related risks associated with the use of the HTTP 'ETag' header?

There are no significant risks here.

Should the use of ETags be entirely avoided for security and privacy concerns as a result of those risks?

No. First, using the Etag instead of a cookie to track users is not using the Etag as designed but is abusing it. And there are other methods which can be used for this - basically all things which result in storing something in the users browser. This includes cookies, Last-Modified header, permanent redirects (301), local storage, HSTS, ...

Also modern browsers support state partitioning where they keep site specific states (cookies, Etag, ...) to their origin and do not sent it if included as third party. This prevents cross-site tracking using Etag too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .