Re: [VulnDiscuss] RE: TRACE used to increase the dangerous of XSS.

On Thu, 23 Jan 2003, Thor Larholm wrote:

> There's hardly anything to fix in the first place.
>
> Being able to send TRACE requests to the server is not an issue, unless you
> don't trust the client to see its own data.

Isn't that the whole point of security zones?  You don't trust some
operations/data of the client to interact with other operations/data of
the client.  So yes, it's a fact that we don't trust the client to see
it's own data.

Further, you mentioned earlier that the XMLHTTP control can see whatever
Set-Cookie headers are coming in.  That is true.  But it can't see what
Cookie and Authorization headers are sent out.  This has to do with
accessing what the browser already knows, not what the server is telling
us.

And a question for everyone: what methods can a website use to access the
username and password used for HTTP authorization?

If there are methods, then I will admit this doesn't provide us more than
the regular, known XSS bugs.  But if there are no methods, well, then this
is giving access to sensitive data previously unaccessible.

Everyone seems to be conveniently ignoring that aspect of this attack.

- rfp