DX SPECTRUM, Is HTTP OPTIONS a Vulnerability in DX Spectrum?

[Sabino Arriero]

Hello Broadcom Community,

A customer has requested that the HTTP OPTIONS method be disabled on our DX Spectrum environment as part of their security requirements.

Could you please confirm whether the availability of the HTTP OPTIONS method is considered a vulnerability in DX Spectrum?

If it is not considered a vulnerability, are there any known impacts or side effects of disabling the HTTP OPTIONS method on the Spectrum web server or any related components?

We would appreciate any recommendations or best practices regarding this configuration.

Thank you in advance for your support.

[Mohammed Alfakhrany]

Hi Sabino,

The OPTIONS method is not a direct exploit or a software vulnerability within DX Spectrum's Tomcat web server.

It is typically classified by security scanners as an Information Disclosure or "low-severity" finding. The OPTIONSmethod is simply used by a client to ask the server, "What HTTP methods do you support?" (e.g., GET, POST, PUT). Scanners flag this because it can theoretically be used by an attacker during the reconnaissance phase to map out what actions are allowed on the web server.

Disabling the OPTIONS method is fully supported by Broadcom and will not negatively impact standard OneClick console operations, alarm processing, or native NetOps integrations. The following KB article shows how:

KB : How to Disable the HTTP OPTIONS in OneClick's Tomcat Server