verb-tampering

HTTP Verb / Method Tampering

Authorization is enforced for GET/POST but not for HEAD, OPTIONS, PATCH, DELETE, PUT, TRACE, TRACK, or arbitrary verbs like FOO. Or the app respects X-HTTP-Method-Override and the WAF/auth filter does not. Or the framework routes any verb to the same handler while only the POST ACL rule exists. Severity is High to Critical when it grants admin-only actions or reads protected data.

1. Why it works

• Apache/nginx Limit/LimitExcept rules in .htaccess often list only GET POST. Any other verb is unrestricted.
• Tomcat / JSP <security-constraint><http-method>GET</http-method> only constrains the listed verbs (the famous "Tomcat verb tampering" class — CVE-2017-12615, CVE-2009-3548 family).
• API gateways enforce method-specific policies; the upstream service treats verbs identically.
• Spring @RequestMapping without method= accepts every verb. @GetMapping/@PostMapping constrain, but generic mappings do not.
• Express.js app.all(path, handler) answers every method.
• Framework method-override middleware (methodOverride in Express, Rails _method=DELETE, X-HTTP-Method-Override in many) lets a POST become a DELETE after auth runs.
• Many WAFs ship rule sets keyed on GET/POST only.

2. Detection — does the endpoint answer non-standard verbs?

# Verb sweep
for m in GET HEAD POST PUT PATCH DELETE OPTIONS TRACE TRACK CONNECT PROPFIND COPY MOVE LOCK UNLOCK MKCOL FOO; do
  code=$(curl -sk -o /dev/null -w '%{http_code} %{size_download}' -X "$m" "http://<TARGET>/admin/users")
  printf '%-10s -> %s\n' "$m" "$code"
done

# Compare auth-required endpoint without creds, per verb
for m in GET HEAD POST PUT PATCH DELETE OPTIONS; do
  curl -sk -o /dev/null -w "%-7s %{http_code}\n" -X "$m" "http://<TARGET>/admin/secret"
done
# If GET=401 but HEAD/OPTIONS=200 → verb-based auth bypass candidate.

HEAD is the highest-yield: per RFC 9110 it MUST be treated like GET minus the body, but servers diverge — middleware sometimes short-circuits auth on HEAD. Response headers and status leak data even with no body.