Apache Optionsbleed is yet another vulnerability in an ever-growing list of threats targeting REST-based back-end applications aimed at compromising server memory. In this case, it is Apache’s https program can be compromised by using HTTP method OPTIONS as described here:
– https://nakedsecurity.sophos.c
– https://arstechnica.com/inform
Forum Sentry protects against this attack as one of the many API threat vectors that Sentry protects against. This particular threat vector was detailed as #3 in our “Top 10 API Threats” list. The HTTP method is heavily utilized in REST-based apps and services where commonly used HTTP methods such as POST, GET, PUT and DELETE for CRUD (Create Read Update Delete) services. Forum Sentry API Security policies restrict the methods allowed to be used. Additionally, these restrictions can be user-specific with granular authorization that can be applied to any HTTP method.
Forum Sentry protected 100% of its customers from Heartbleed, and today protects 100% of its customers from this latest OptionsBleed vulnerability.
Click here to learn more about how Forum Sentry can protect your APIs