Catalog/VULNERABILITY/http-methods
SCAN-ID: HTTP-METHODSREVISION 2026.4
VULNERABILITYCVSS 5.4 (MEDIUM)

HTTP Method Tampering & Verb Tunneling Scanner

Check if unneeded HTTP verbs (TRACE, TRACK, PUT, DELETE) are exposed or allow authentication filter bypasses.

Technical Scope & Verification Behavior

Sends TRACE requests to check for Cross-Site Tracing (XST), tests X-HTTP-Method-Override headers, and evaluates preflight OPTIONS permissions.

Automated Inspection Checks (6)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

TRACE / HTTP/1.1

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Disable TRACE in Nginx

patch.diff (nginx)
--- a/handler.nginx (Vulnerable)
# Default allows all methods
+++ b/handler.nginx (Remediated)
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|OPTIONS)$ ) {
    return 405;
}

Reject unexpected HTTP methods at the reverse proxy layer to protect against HTTP verb tunneling.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Configure server to return 405 Method Not Allowed on all TRACE and TRACK HTTP requests."

Run Isolated Check

Test your public domain specifically for HTTP Method Tampering & Verb Tunneling Scanner.

100% passive • No server load

Specification Details

CVSS Score
5.4 / 10.0
Severity Level
MEDIUM
Category
VULNERABILITY
Test Vectors
6 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#HTTP#Methods#XST

Run continuous monitoring for HTTP Method Tampering & Verb Tunneling Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog