topic Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed in Expedition Discussions

Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

ShravanKumar — Fri, 01 Apr 2022 08:06:05 GMT

Vulnerability Name:
11213:HTTP TRACE / TRACK Methods Allowed

Affected Hosts, Port(s), Vulnerability IDs:
Panmigration tool , tcp:80, 11213

I see this Vulnerability on the Expedition Migration tool. Could you please suggest mitigation plan?

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

lychiang — Fri, 01 Apr 2022 16:44:05 GMT

Hi @ShravanKumar httpd is not enabled in Expedition VM, you can try to validate using below command :

curl -i expedition -X TRACE http://{yourexpeditionIP}/

You should get response back like below:

curl: (7) Failed to connect to {yourexpeditionIP} port 80: Connection refused

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

ShravanKumar — Wed, 06 Apr 2022 10:03:11 GMT

Hi Lychiang,

Thanks for the reply. I'm getting below. May I know is this something we can mitigate on the server level? as this is a custom tool?

shravaxxxxx:~ shravaxxxxx$ curl -i panmig-xxxx.xxx.vmware.com -X TRACE http://10.166.xxx.xxx

HTTP/1.1 200 OK

Date: Wed, 06 Apr 2022 09:33:12 GMT

Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.7

Transfer-Encoding: chunked

Content-Type: message/http

TRACE / HTTP/1.1

Host: panmig-xxx.xxx.vmware.com

User-Agent: curl/7.77.0

Accept: */*

HTTP/1.1 200 OK

Date: Wed, 06 Apr 2022 09:33:15 GMT

Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.7

Transfer-Encoding: chunked

Content-Type: message/http

TRACE / HTTP/1.1

Host: 10.166.xxx.xxx

User-Agent: curl/7.77.0

Accept: */*

shravxxxxx-a02:~

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

dgildelaig — Wed, 06 Apr 2022 16:29:25 GMT

Hi,

Which version of Expedition are you running?

The signature that we see from your running command refers to CentOS, but Expedition is offered under Ubuntu.

Also, I do not think we expose the tcp/80 on Expedition. When available, it directly redirects to tcp/443.

Are you certain you are targeting an Expedition instance?

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

ShravanKumar — Thu, 07 Apr 2022 08:17:22 GMT

I'm sure I'm targetting expedition tool IP.

We have deployed this tool on a Centos VM in our environment... do you think this Vulnerability is detected for that server? and not the tool?

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

ShravanKumar — Mon, 11 Apr 2022 06:39:18 GMT

I'm sure I'm targetting expedition tool IP.

We have deployed this tool on a Centos VM in our environment... do you think this Vulnerability is detected for that server? and not the tool?

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

lychiang — Mon, 11 Apr 2022 17:18:05 GMT

Could be, then please follow the suggested remediation method for centos

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

ShravanKumar — Wed, 13 Apr 2022 13:46:14 GMT

May I know what is the root password of Expedition tool? and how to check the current version and what is the procedure to upgrade to next version?

Re: Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

lychiang — Wed, 13 Apr 2022 16:48:28 GMT

by default is "paloalto" but you could give specific root password during ubuntu installation, You can login to the expedition GUI and check the version in the dashboard, in the ubuntu CLI, you issue below commands to upgrade the tool to the latest version:

sudo apt-get update

sudo apt-get install expedition-beta