Download Netsparker
Pricing
Blog
Contact
Netsparker

Web Server Allows TRACE and TRACK HTTP Methods

Netsparker detected the TRACE/TRACK method is allowed.

Impact

It is possible to bypass the HttpOnly cookie limitation and read the cookies in a cross-site scripting attack by using the TRACE/TRACK method within an XmlHttpRequest. This is not possible with modern browsers, so the vulnerability can only be used when targeting users with unpatched and old browsers.

Remedy

Disable this method in all production systems. Even though the application is not vulnerable to cross-site scripting, a debugging feature such as TRACE/TRACK should not be required in a production system and therefore should be disabled.

External References


Go back to the Complete list of Vulnerability Checks.