0

由于“WebDAV 扩展已启用”，我们未能在我们客户的网站上进行 PCI 扫描。获取端口 80/tcp 和端口 443/tcp 运行易受攻击的 HTTP 服务：Apache 2.4.3。禁用 Apache dav，dav_fs 不起作用。

httpd.conf：

ServerRoot "/usr/local/apache"   
Listen 80    
LoadModule authn_file_module modules/mod_authn_file.so   
LoadModule authn_socache_module modules/mod_authn_socache.so   
LoadModule authn_core_module modules/mod_authn_core.so   
LoadModule authz_host_module modules/mod_authz_host.so   
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so   
LoadModule authz_user_module modules/mod_authz_user.so   
LoadModule authz_core_module modules/mod_authz_core.so    
LoadModule access_compat_module modules/mod_access_compat.so   
LoadModule auth_basic_module modules/mod_auth_basic.so   
LoadModule auth_digest_module modules/mod_auth_digest.so   
LoadModule cache_module modules/mod_cache.so   
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so   
LoadModule reqtimeout_module modules/mod_reqtimeout.so   
LoadModule filter_module modules/mod_filter.so    
LoadModule mime_module modules/mod_mime.so   
LoadModule log_config_module modules/mod_log_config.so   
LoadModule env_module modules/mod_env.so   
LoadModule headers_module modules/mod_headers.so   
LoadModule setenvif_module modules/mod_setenvif.so   
LoadModule version_module modules/mod_version.so   
LoadModule ssl_module modules/mod_ssl.so   
LoadModule unixd_module modules/mod_unixd.so   
LoadModule status_module modules/mod_status.so   
LoadModule dir_module modules/mod_dir.so   
LoadModule alias_module modules/mod_alias.so   
LoadModule rewrite_module modules/mod_rewrite.so   
LoadModule php5_module modules/libphp5.so    

    ServerAdmin abc@example.com   
    ServerName www.example.com:80   
    <Directory />    
    AllowOverride none   
    Require all denied    
    </Directory>   
TraceEnable off   
DocumentRoot "/var/www/html"   
    <Directory "/var/www/html">    
    Options Indexes FollowSymLinks   
    AllowOverride All   
    </Directory>    
    <IfModule dir_module>    
    DirectoryIndex index.php index.html    
    </IfModule>    
ErrorLog "logs/error_log"   
LogLevel warn   
    <IfModule log_config_module>    
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined   
    LogFormat "%h %l %u %t \"%r\" %>s %b" common   
    <IfModule logio_module>    
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio    
     </IfModule>     
    CustomLog "logs/access_log" common    
    </IfModule>    
    <IfModule mime_module>    
    TypesConfig conf/mime.types    
    AddType application/x-compress .Z    
    AddType application/x-gzip .gz .tgz    
    AddType text/html       .php    
    AddType application/x-httpd-php-source phps    
    AddHandler php5-script  .php    
    </IfModule>    
    Include conf/extra/httpd-ssl.conf    
    <IfModule ssl_module>    
SSLRandomSeed startup builtin    
SSLRandomSeed connect builtin    
    </IfModule>    
    <IfModule setenvif_module>    
BrowserMatch "MSIE 10.0;" bad_DNT    
    </IfModule>    
    <IfModule headers_module>    
RequestHeader unset DNT env=bad_DNT    
    </IfModule>    
Timeout 60    
StartServers 1   
    <IfModule prefork.c>    
MinSpareServers 1   
MaxSpareServers 1    
    </IfModule>    
ServerLimit 256    
MaxClients 25   
MaxRequestsPerChild 80   
KeepAlive On   
KeepAliveTimeout 5   
MaxKeepAliveRequests 30

.htaccess

 Options -Indexes    
    <IfModule mod_rewrite.c>    
RewriteEngine On  
RewriteBase /  
RewriteRule ^index\.php$ - [L]  
RewriteCond %{REQUEST_FILENAME} !-f  
RewriteCond %{REQUEST_FILENAME} !-d  
RewriteRule . /index.php [L]    
    </IfModule>    
RewriteEngine on  
RewriteCond %{REQUEST_METHOD} ^HEAD  
RewriteRule .* ~@~S[F]  
RewriteCond %{DAV} !^$  
RewriteRule . - [L]

请帮忙。提前致谢。

4

1 回答 1

0

I had the same problem and it was a false positive. I logged into my server with ssh, typed httpd -M to list modules loaded, and sent a screenshot of that session to the ASV to prove that dav modules were not loaded. The issue was closed.

于 2012-10-12T17:15:57.387 回答