On this page

Atomicorp WAF Rule 340002

Rule Summary

  • Rule ID: 340002
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: TRACE/TRACK method denied
  • Observed CWEs: None documented
  • Revision: 3
  • Rule severity: Critical (2)
  • Phase: 1 (request headers)
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

TRACE and TRACK are valid HTTP methods used to do low level debugging of web applications by echoing back input back to the connecting system or user. TRACE and TRACK can be used to steal cookies or other website credentials.

False Positives

If you use this method this rule can be triggered. It is almost never used legitimately and should always be disabled on Internet facing systems or systems that may receive traffic from potentially hostile users or systems.

Similar Rules

WAF_340361 - This rule disables the CONNECT method. Although for a different reason, the rules are very similar.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 340002
  • Source revision: 657
  • Source revision date: 2009-11-25