解决安全扫描Insecure HTTP Methods Enabled的问题

最新推荐文章于 2024-03-13 09:54:10 发布

weixin_30664539

最新推荐文章于 2024-03-13 09:54:10 发布

阅读量502

点赞数

CC 4.0 BY-SA版权

文章标签：测试 java web.xml

原文链接：http://www.cnblogs.com/Mainz/archive/2012/11/19/2777679.html

本文介绍了如何在CentOS上部署使用SpringMVC的Java网站并配置HTTPS/SSL8443端口后，通过设置web.xml文件来解决InsecureHTTPMethodsEnabled漏洞，避免上传、修改或删除网页、脚本和文件的风险。

今天把Spring MVC的Java网站部署到CentOS上，并且设置了https/ssl 8443端口，然后用IBM Rational AppScan进行安全扫描，发现一个漏洞：Insecure HTTP Methods Enabled. 原因是Tomcat支持的http命令中包含DELETE、OPTIONS、PUT、HEAD和TRACE这五条命令。

漏洞描述和建议：

Insecure HTTP Methods Enabled

Severity: Medium
Type: Infrastructure test
WASC Threat Classification: Client-side Attacks: Content Spoofing
CVE Reference(s): N/A
Security Risk: It is possible to upload, modify or delete web pages, scripts and files on the web server

Fix Recommendation
If you do not need WebDAV enabled on your server, make sure that you either disable it, or disallow HTTP methods (verbs) that are unneeded.

解决办法

参考了这个帖子，但小题大做了，只需修改网站的web.xml添加下面的内容即可。

< security-constraint >
      < web-resource-collection >
           < web-resource-name >DisableUnsecureHttpActions </ web-resource-name >
           < url-pattern >/* </ url-pattern >
           < http-method >DELETE </ http-method >
           < http-method >PUT </ http-method >
           < http-method >HEAD </ http-method >
           < http-method >TRACE </ http-method >
           < http-method >OPTIONS </ http-method >
      </ web-resource-collection >
      < auth-constraint >
         < role-name >NotExistingRole </ role-name >
      </ auth-constraint >
      < user-data-constraint >
         < transport-guarantee >NONE </ transport-guarantee >
      </ user-data-constraint >
</ security-constraint >

有关Security-constraint的理解，可以参考这个帖子。