What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response.
This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set.
The HTTP TRACE method is used for debugging purposes only and should be disabled.
IIS Registry Setting:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters EnableTraceMethod: 0