Why is PUT method not allowed and how can I allow PUT methods without changing REQUEST-901-INITIALIZATION.conf file and REQUEST-911-METHOD-ENFORCEMENT.conf file.
-
Possible duplicate of security.stackexchange.com/questions/38635/… and security.stackexchange.com/questions/21413/…– NosajimikiCommented Aug 29 at 15:25
Add a comment
|
2 Answers
I suspect that this is largely a legacy thing, because the list of allowed methods (GET HEAD POST OPTIONS) in the CRS hasn't changed for at least 12 years and probably longer.
Historically the PUT method was used by WebDAV to allow files to be created on the web server - which if misconfigured became an unauthenticated file upload vulnerability as it allowed an attacker to upload (or overwrite) arbitrary files on the webserver. Very much something that you'd want a WAF to block by default.
But nowadays very few people are using WebDAV, and PUT is mostly used by REST APIs, so blocking it by default doesn't make as much sense. You can allow other methods by adding them to the tx.allowed_methods variable in your CRS configuration. But it might also be worth making an issue or a pull request on the CRS GitHub to suggest changing this default behaviour, and see whether there are other reasons they want to keep it?
I'm not sure there is any strict reason why only the GET, HEAD, POST and OPTIONS methods are allowed by default. I assume CRS tries to minimize the risk, and these are enough for more users.
You can enable other methods in crs.conf file: remove comment marks from rule 900200 and put all methods what you need.
