Penetration test finding: HTTP verb tampering risk from PROPFIND and BPROPFIND methods

Issue

Penetration tests flag that Mendix applications are vulnerable to HTTP verb tampering with the PROPFIND and BPROPFIND WebDAV methods, due to them returning an 403 Forbidden response rather than an 405 Method Not Allowed response.

Environment

Studio Pro (all versions)

Cause

PROPFIND and BPROPFIND are legacy WebDAV methods, not REST/HTTP methods that Mendix applications use. They are standard probes fired by security scanning tools at every web server. Both are non-standard, legacy extensions that are only relevant on servers with WebDAV enabled.

Solution/Workaround

Findings like this can be documented as false positives for the following reasons:

• The methods PROPFIND and BPROPFIND are legacy WebDAV methods and are not used by Mendix applications.
• A 403 Forbidden response is a rejection.
• HTTP message tampering cannot bypass security in a Mendix app, because authorization is enforced server-side through entity access rules and allowed roles on microflows/nanoflows, independent of the verb, headers, or body of the request.

Additional information

Mendix documentation: HTTP Message Tampering