HTTP Methods

[#1]

Hi friends, hope all of you are fine.

This time I have an issue about the HTTP Methods, a client, run some vulnerabilties test in QV Server, and found some non safe methods (PUT, DELETE, TRACE, OPTIONS, MKDIR, CONNECT, RMDIR, PROPATCH, COPY, LOCK)

he ask me if we can close it or disable it.

Does QVWS, use those methods ? if so, does exist a Qliktech technical document, that support the use of those. ?

Or how can I disable that methods.!?

Actually, we are using Qlikview Web server.

Any help , will be appreciate it.

Thanks in advance.

Karim

[danielrozental]

You should probably try using IIS as a webserver as it will probably be easier to configure.

[#3]

It seems that sending an http request to qlikview webserver with another verb than GET or POST always results in "<result><message text='Empty Request'/></result>" responses.

I do not understand what you want to do, how could that be a security problem?

[#4]

Thanks,

I can't  back, and install IIS, because the client doesn't want it.

The IT security department ran a test and wrote me this,

Insecure HTTP methods like PUT, DELETE, TRACE, OPTIONS, MKDIR, CONNECT, RMDIR, PROPATCH, COPY, LOCK. Are enabled. Or at least one of them.

Vulnerability risks.

"the attacker could use any of these HTTP methods to query, create, delete files within the server, as well as the ability to upload a file Shell and complete information about the server."

[rwunderlich]

It sounds like a boilerplate security review question. I would ask support or your salesep for the "standard response" from Qliktech.

As jgeorge pointed out, usng any other verb does nothing useful and returns a standard result. The IT security dept is probably reacting to the fact that the server did not reject those requests. But they overlooked the fact the server does nothing useful with those requests.

-Rob

[Anonymous]

Did u get correct solution? Anybody?

[Anonymous]

QlikTech has given any response to this topic?