HTTP verb tampering

Description

By manipulating the HTTP verb it was possible to bypass the authorization on this directory. The scanner sent a request with a custom HTTP verb (WVS in this case) and managed to bypass the authorization. The attacker can also try any of the valid HTTP verbs, such as HEAD, TRACE, TRACK, PUT, DELETE, and many more.

An application is vulnerable to HTTP Verb tampering if the following conditions hold:

it uses a security control that lists HTTP verbs
the security control fails to block verbs that are not listed
it has GET functionality that is not idempotent or will execute with an arbitrary HTTP verb

For example, Apache with .htaccess is vulnerable if HTTP verbs are specified using the LIMIT keyword:


require valid-user

Remediation

In the case of Apache + .htaccess, don't use HTTP verb restrictions or use LimitExcept.
Check references for more information on how to fix this problem on other platforms.