HTTP TRACE / TRACK Methods Enabled vulnerability in Coldfusion server

Question

I keep getting HTTP TRACE / TRACK Methods Enabled vulnerability in Coldfusion server. Any suggestions to fix this would be of great help.

Answer 1

The blanket disallowing of these methods is more the concern of the HTTP server (IIS, Apache, NGINX ) than the application server (Coldfusion, Lucee). There may be use cases where these HTTP verbs might be legitimately in use.

You can, however, handle this from within the onRequestStart method of Application.cfc with a few lines of code.

var disallowVerbs = [ "TRACE", "TRACK" ];
if( arrayContains( disallowVerbs, cgi.request_method ) ){
    cfheader( statusCode=403, statusText="Method Not Allowed" );
}