HTTP PUT DEL Methods Test

ALTERNATIVE NAMES

AFFECTED SYSTEMS

Web services with Web Dav enabled or PUT word is available on the server.

SEVERITY

High

BACKGROUND

HTTP Protocol itself offers a set of instruction to operate files on the server without having a need for script interpreters such as PHP or .net. A list including brief information about the commands can be searched on the net but the commands needing your attention are listed below:

PUT: Uploads a file to the specified destination
DELETE: Removes the specified file from the server
TRACE: Which replies back with the specified string sent by the client. On its way, it is harmless but may be used for having cross-site tracing.
CONNECT: If the server accepts this command, the server may be used as a proxy.
OPTIONS: The server will reply back revealing the available commands on the header section.

DESCRIPTION

An attacker may execute malicious code on the server by sending the code via HTTP Servers PUT Method.

ANALYSIS

First of all, attackers will check for HTTP methods offered by the server. If the attacker will be able to upload arbitrary files on the server, he/she will try to execute this arbitrary code on the server. This may lead to a leak of valuable data or system-wide information.

SOLUTION

Disable each method on the server that is not used. Practically leaving GET, PUT and HEAD directives is enough. You can have precautions on scripting and server level. Disabling shell functions if not used by the interpreter and having only read permissions to the files those explicitly available for only reading, write and execute permissions should be removed on publicly available files.

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.