Ensure 'HTTP Trace Method' is disabled

MediaNivel 1Automatizadaiis

Descripción

The HTTP TRACE method returns the contents of client HTTP requests in the entity- body of the TRACE response. Attackers could leverage this behavior to access sensitive information, such as authentication data or cookies, contained in the HTTP headers of the request. One such way to mitigate this is by using the <verbs> element of the <requestFiltering> collection. A server-level request filtering verb rule must deny TRACE (allowed=false). PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cómo se verifica

Método de auditoría: Comando de shell

shell

Import-Module WebAdministration -ErrorAction Stop; $t = @(Get-WebConfiguration -Filter 'system.webServer/security/requestFiltering/verbs/add' -PSPath 'MACHINE/WEBROOT/APPHOST' | Where-Object { $_.verb -eq 'TRACE' -and $_.allowed -eq $false }); if ($t.Count -gt 0) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Add-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/requestFiltering/verbs -Name . -Value @{verb='TRACE';allowed='False'}

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: iisrequest-filtering
Referencia: CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.6 Ensure 'HTTP Trace Method' is disabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target iis