topic What is HTTP OPTIONS Method in General Topics

What is HTTP OPTIONS Method

ZEBIT — Tue, 08 Jul 2014 12:32:31 GMT

Hi,

In our ACC I can see that the status bar is 3.7, thanks to the vulnerability HTTP OPTIONS Method. The problem is that I have no idea what this is and how I can fix this.
How can I fix this problem?

Re: What is HTTP OPTIONS Method

DaveCorwin — Tue, 08 Jul 2014 13:39:39 GMT

OPTIONS Method

The OPTIONS method is used by the client to find out what are the HTTP methods and other options supported by a web server. The client can specify a URL for the OPTIONS method, or an asterisk (*) to refer to the entire server. The following example request a list of methods supported by a web server running on tutorialspoint.com:

OPTIONS * HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

HTTP Methods

________________

How to fix the issue:

From what I have researched, I believe you can only configure your web servers to not allow this method. There is nothing on the firewall that can be done.

Re: What is HTTP OPTIONS Method

pulukas — Tue, 08 Jul 2014 16:52:23 GMT

As Dave mentioned, you would need to turn this off on the web server.

With Microsoft IIS you would use user request filtering to remove the options keyword.

Use Request Filtering : The Official Microsoft IIS Site

You may also be interesting in the MS Technet article on hardening production IIS servers and the lockdown tool.

Security Guidance for IIS

Re: What is HTTP OPTIONS Method

hshah — Tue, 08 Jul 2014 17:30:58 GMT

Good one Steven ....