Vulnerability Name: 11213:HTTP TRACE / TRACK Methods Allowed

[ShravanKumar]

Vulnerability Name:
11213:HTTP TRACE / TRACK Methods Allowed

Affected Hosts, Port(s), Vulnerability IDs:
Panmigration tool , tcp:80, 11213

I see this Vulnerability on the Expedition Migration tool. Could you please suggest mitigation plan?

[lychiang]

Hi @ShravanKumar httpd is not enabled in Expedition VM, you can try to validate using below command :

curl -i expedition -X TRACE http://{yourexpeditionIP}/

You should get response back like below:

curl: (7) Failed to connect to {yourexpeditionIP} port 80: Connection refused

[ShravanKumar]

Hi Lychiang,

Thanks for the reply. I'm getting below. May I know is this something we can mitigate on the server level? as this is a custom tool?

shravaxxxxx:~ shravaxxxxx$ curl -i panmig-xxxx.xxx.vmware.com  -X TRACE http://10.166.xxx.xxx

HTTP/1.1 200 OK

Date: Wed, 06 Apr 2022 09:33:12 GMT

Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.7

Transfer-Encoding: chunked

Content-Type: message/http

TRACE / HTTP/1.1

Host: panmig-xxx.xxx.vmware.com

User-Agent: curl/7.77.0

Accept: */*

HTTP/1.1 200 OK

Date: Wed, 06 Apr 2022 09:33:15 GMT

Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.7

Transfer-Encoding: chunked

Content-Type: message/http

TRACE / HTTP/1.1

Host: 10.166.xxx.xxx

User-Agent: curl/7.77.0

Accept: */*

shravxxxxx-a02:~

[dgildelaig]

Hi,

Which version of Expedition are you running?

The signature that we see from your running command refers to CentOS, but Expedition is offered under Ubuntu.

Also, I do not think we expose the tcp/80 on Expedition. When available, it directly redirects to tcp/443.

Are you certain you are targeting an Expedition instance?

[ShravanKumar]

I'm sure I'm targetting expedition tool IP. 

We have deployed this tool on a Centos VM in our environment... do you think this Vulnerability is detected for that server? and not the tool?

[ShravanKumar]

I'm sure I'm targetting expedition tool IP. 

We have deployed this tool on a Centos VM in our environment... do you think this Vulnerability is detected for that server? and not the tool?

[lychiang]

Could be, then please follow the suggested remediation method for centos 

[ShravanKumar]

May I know what is the root password of Expedition tool? and how to check the current version and what is the procedure to upgrade to next version?

[lychiang]

by default is "paloalto" but you could give  specific root password during ubuntu installation,  You can login to the expedition GUI and check the version in the dashboard, in the ubuntu CLI, you issue below commands to upgrade the tool to the latest version:

sudo apt-get update

sudo apt-get install expedition-beta