OPTIONS Method Enabled
Unknown
Vulnerability Details
Vulnerability Details:-
I detected that OPTIONS method is allowed. This issue is reported as extra information.
Impact:-
Information disclosed from this page can be used to gain additional information about the target system.
Remedy:-
Disable OPTIONS method in all production systems.
POC :-
Request :-
OPTIONS /wp-content/themes/theme/js/ HTTP/1.1
Host: c2fo.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Responce :-
HTTP/1.1 200 OK
Connection: keep-alive
Date: Wed, 02 Apr 2014 17:21:31 GMT
Server: WP Engine/6.0.2
Keep-Alive: timeout=20
X-Type: default
X-Frame-Options: SAMEORIGIN
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 0
Content-Type: httpd/unix-directory
Actions
View on HackerOneReport Stats
- Report ID: 5654
- State: Closed
- Substate: resolved
- Upvotes: 3