Zipkin: Zipkin - Track and Trace method vulnerability

[monicaplb]

Hi all,

My company's security dept has notified me of a vulnerability in on one of our hosts. Specifically, it's on port 9411: our Zipkin container.

The indicated vulnerability is this one: [https://www.tenable.com/plugins/nessus/11213]

So, I have these 2 doubts:

• Is Zipkin functionality dependent on these 2 HTTP methods or can they be disabled?
• And if not, how do I disable those 2 HTTP methods? As Zipkin is a Spring Boot application, I don't know if this is externally configurable.

Thanks!

[adriancole]

we dont actively support those methods. I suspect we could just turn them
off somehow.

[shakuzen]

According to my testing, TRACK is already disallowed. TRACE is indeed allowed currently.

I couldn't find a Spring Boot exposed property to control this kind of thing with external configuration, so we will probably have to add some configuration internally for it.

[jorgheymans]

@anuraaga I checked this and TRACK is indeed still disallowed whereas TRACE is. Maybe there's an easy toggle in Armeria to disallow this ?

$ curl -i -X TRACE http://localhost:9411/zipkin
HTTP/1.1 302 Found
location: /zipkin/
content-length: 0
server: Armeria/0.99.3
date: Sun, 19 Apr 2020 20:43:36 GMT

$ curl -i -X TRACK http://localhost:9411/zipkin
HTTP/1.1 405 Method Not Allowed
content-type: text/plain; charset=utf-8
content-length: 41
server: Armeria/0.99.3
date: Sun, 19 Apr 2020 20:43:40 GMT

405 Method Not Allowed
Unsupported method

[anuraaga]

Yup should be pretty simple so will add the tweak. For reference, there isn't really a security vulnerability since we don't "actually implement TRACE", which would involve returning the request headers in the response, we just return what we would have on a GET. So no rush to release a patch IMO.