Detections
Analytics

OH12-1X-000200 - OHS must restrict access methods - LimitExcept GET POST

Information

The directive '<LimitExcept>' allows the system administrator to restrict what users may use which methods. An example of methods would be GET, POST and DELETE. These three are the most common used by applications and should be allowed. Methods such as TRACE, if allowed, give an attacker a way to map the system so that vulnerabilities to the system can be researched and developed.

Solution

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the '<LimitExcept>' directive at the directory configuration scope.

3. Set the '<LimitExcept>' directive to 'GET POST', add the directive if it does not exist.

4. Within the '<LimitExcept GET POST>' directives, add the directive 'Deny' and set it to 'from all'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_HTTP_Server_12-1-3_V2R3_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-221438r961863_rule, STIG-ID|OH12-1X-000200, STIG-Legacy|SV-79129, STIG-Legacy|V-64639, Vuln-ID|V-221438

Plugin: Unix

Control ID: 23f0e2b2c03ff65d50fed52967817c5f53aedec485de0237ec5ac6ab9ce3f37d