AlertLogic Vulnerability : "" Web Server Allows cross-Site Tracing"" : Suggestion Needed

THis iRule can block these methods but a few adjustments are needed:

1) matchclass is a old, with version 11.x you should use [class match ...] 2) [matchclass ] or [class match ..] do not work on TCL lists or arrays , they operate on BigIP datagroups. Create a "String" based datagroup and reference it in the irule.

3) Rather than listing the disallowed methods, the allowed list is shorter.

ltm data-group internal /Common/allowed_http_methods {
    records {
    "GET"
    "POST"
    }
    type string
}

ltm rule only_allowed_nethods {
when HTTP_REQUEST { 
      if { not ( [class match [HTTP::method] equals /Common/allowed_http_methods] ) }  
      { reject }
}

}

HTH

Hi John,

 

ok so apart from GET and POST, it will reject others right, and whether it will create any issues or disruption in regular WEB traffic.

 

Thanks and Regards PZ

 

Parveez:

 

This will not do anything to any request where the Method is included in the datagroup.

 

If you capture the requests on the browser side using Fiddler or HTTPwatch or similar tools, you will be able to tell if there are any other HTTP Methods you may want to allow.

 

HTH.

 

Ok John, thank you so much for your earnest suggestion. Will do so.

 

Thanks and Regards Parveez