California Consumer Privacy Act (CCPA) Opt-Out Icon

HTTP TRACE method vulnerabilities are identified as follows: CVE-2022-38115A serious security issue for public-facing websites. This vulnerability allows attackers to exploit the HTTP TRACE method, which can be misused for cross-site scripting (XSS) attacks. Such attacks can allow malicious actors to intercept and manipulate user data, leading to unauthorized access, data breaches, and other security incidents.

Identify the problem

To diagnose the problem, open a PowerShell console and run the following command to check if the server responds to the TRACE method.

Invoke-WebRequest -Uri http://: -Method TRACE -Details

You can also identify the same using the curl command.

curl -v -X trace http://:

In both scenarios, the server responded with status code 200 to the TRACE method. This confirms that the site is vulnerable and can be identified as follows: CVE-2022-38115.

way out

There are several ways to resolve the vulnerability. You can resolve it by following one of the methods described below.

Request Filtering

You can use the built-in IIS feature, Request Filtering. Open IIS Manager, navigate to your site, and open the “Request Filtering” module. From there, go to the HTTP Verbs section.

In the right task pane, “Verb of rejection. A “Deny Verb pop-up window will appear. “Track” as the verb and click OK as shown in the figure. Then restart the application pool or IIS to apply the settings.

You can get the same result by modifying it. web.config file. To do this, locate the web.config file in the root directory of your web application and add the following configuration: tag.

To test your changes, try accessing the URL using the TRACE method. You should see a 404.6 Not Found error.

Registry settings

You can also fix the vulnerability by updating registry settings. Open the registry editor and click “Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters“.

Backup your registry before updating. Set DWORD. Activate tracking method In value 0See the documentation for more information about the EnableTraceMethod value. Using Registry Keys – Internet Information Services | Microsoft Learn.

After making this change, restart IIS to apply it. To test it, access the URL using the TRACE method. You should receive a 501 – Not Implemented status code.