OPTIONS Method Enabled

Disclosed: 2014-04-07 14:24:52 By yourdarkshadow To c2fo
Unknown
Vulnerability Details
Vulnerability Details:- I detected that OPTIONS method is allowed. This issue is reported as extra information. Impact:- Information disclosed from this page can be used to gain additional information about the target system. Remedy:- Disable OPTIONS method in all production systems. POC :- Request :- OPTIONS /wp-content/themes/theme/js/ HTTP/1.1 Host: c2fo.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Responce :- HTTP/1.1 200 OK Connection: keep-alive Date: Wed, 02 Apr 2014 17:21:31 GMT Server: WP Engine/6.0.2 Keep-Alive: timeout=20 X-Type: default X-Frame-Options: SAMEORIGIN Allow: GET,HEAD,POST,OPTIONS,TRACE Content-Length: 0 Content-Type: httpd/unix-directory
Actions
View on HackerOne
Report Stats
  • Report ID: 5654
  • State: Closed
  • Substate: resolved
  • Upvotes: 3
Share this report