1

Our security team ran a web-inspect security scan on our site and asked us to disable verb tunneling using headers or query parameters such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to prevent attackers from using an override method to use restricted HTTP methods. Is there a way in nginx configurations where we can disable this verb tunneling ?

3
  • Is your nginx server reverse proxying the content? If so, you can override headers during the proxy process as described here: stackoverflow.com/questions/44536548/… Commented Dec 7, 2017 at 9:40
  • I think it is likely your web application that supports these action overrides rather than nginx itself. What web-app are you using? Commented Dec 7, 2017 at 9:41
  • Thanks for responding @StephenOstermiller . Will look into modifying headers while reverse proxying the content. Our upstream servers are with fastcgi_pass (php-fpm servers). Web application is Drupal 7.
    – Sriram
    Commented Dec 8, 2017 at 15:48

1 Answer 1

1

It looks like you're getting the issue "Often Misused: HTTP Method Override" reported by Fortify's WebInspect scanner. To resolve this for my team I implemented a filter in the WebApp itself that listens for our bad headers (x-http-method, x-http-method-override, x-method-override), sets status to 405, and breaks if they are found. See code below. I know this is not the most graceful solution, but it is the only one I found that satisfies the scan (throwing an error and booting the user did not satisfy).

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest hsReq = (HttpServletRequest) req;
    HttpServletResponse hsRes = (HttpServletResponse) res;

    hsRes.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
    hsRes.setHeader("Pragma", "no-cache");
    hsRes.setDateHeader("Expires", 0);
    hsRes.setHeader("X-XSS-Protection", "1; mode=block");
    hsRes.addHeader("X-Content-Type-Options", "nosniff");
    hsRes.setHeader("Content-Security-Policy", "frame-ancestors 'none'; default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'");
    hsRes.setHeader("X-FRAME-OPTIONS", "DENY");
    hsRes.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains;");

    // This resolves "Often Misused: HTTP Method Override"
    hsRes.setHeader("Access-Control-Allow-Methods", "GET, POST");
    String methodParam = hsReq.getParameter("_method");
    if (methodParam != null){
        LOG.error("\n Bad actor is attempting to use HTTP Method Tunneling. \n");
        hsRes.reset();
        hsRes.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
        return;
    }
    String xhmHeader = hsReq.getHeader("x-http-method");
    String xhmoHeader = hsReq.getHeader("x-http-method-override");
    String xmoHeader = hsReq.getHeader("x-method-override");
    if ((xhmHeader != null) || (xhmoHeader != null) || (xmoHeader != null)){
        LOG.error("\n Bad actor is attempting to use HTTP Method Tunneling. \n");
        hsRes.reset();
        hsRes.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
        return;
    }

    chain.doFilter(req, res);
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.