topic Re: OPTIONS Method enabled vulnerability detected on gateways WAN IP. in General Topics

OPTIONS Method enabled vulnerability detected on gateways WAN IP.

Samsur121 — Tue, 12 Sep 2023 11:16:31 GMT

Anyone have any idea to close "OPTIONS Method enabled" VA on checkpoint firewall. Our VAPT team scans the firewall WAN IP and detected this "application supports the OPTIONS HTTP method due to web server misconfiguration."

Re: OPTIONS Method enabled vulnerability detected on gateways WAN IP.

G_W_Albrecht — Tue, 12 Sep 2023 11:46:22 GMT

Options is regarded safer as it is read only, different to post or put - and web servers today do operate on https only. So why this is a vulnerability, please give sources / references !

Re: OPTIONS Method enabled vulnerability detected on gateways WAN IP.

Chris_Atkinson — Tue, 12 Sep 2023 12:32:29 GMT

Encourage you to share further details via a support ticket for review.

Re: OPTIONS Method enabled vulnerability detected on gateways WAN IP.

G_W_Albrecht — Tue, 12 Sep 2023 13:15:33 GMT

HTTP Methods in logs?

Query with HTTP(S) methods

Re: OPTIONS Method enabled vulnerability detected on gateways WAN IP.

Samsur121 — Sat, 30 Sep 2023 10:43:54 GMT

Thank you all for the updates, It was false a positive.

Re: OPTIONS Method enabled vulnerability detected on gateways WAN IP.

Antonis_Hassiot — Fri, 27 Dec 2024 09:32:36 GMT

We also had this identified as vulnerability from external pentest:

Extended HTTP Methods Allowed

By issuing an "OPTIONS" Web Request to the remote Web Server (HTTP OPTIONS Method), we have managed to identify the extended HTTP Methods supported.

We have managed to identify that the remote Web Server supports the following HTTP Methods:

Based on the response to an OPTIONS request :

- HTTP methods GET HEAD OPTIONS POST are allowed on :

/sslvpn/Login

Some of the extended HTTP methods that are configured on the remote web server can potentially pose a security risk for the web application(s), as they provide the opportunity to an attacker to modify the files stored on the web server or disclose sensitive information such as the base names and extensions used by the webserver.

Any idea why it's enabled and how we can disable?