PCI SCAN Failure due to WebDav - apache

Question

We are failed to PCI scan on one of our client's website due to "WebDAV Extensions are Enabled". Getting Port 80/tcp and Port 443/tcp Running vulnerable HTTP service: Apache 2.4.3.Disabling Apache dav, dav_fs didn't worked.
httpd.conf :
ServerRoot "/usr/local/apache"
Listen 80
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_socache_module modules/mod_authn_socache.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule access_compat_module modules/mod_access_compat.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule cache_module modules/mod_cache.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule filter_module modules/mod_filter.so
LoadModule mime_module modules/mod_mime.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule version_module modules/mod_version.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule status_module modules/mod_status.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule php5_module modules/libphp5.so
ServerAdmin abc#example.com
ServerName www.example.com:80
<Directory />
AllowOverride none
Require all denied
</Directory>
TraceEnable off
DocumentRoot "/var/www/html"
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride All
</Directory>
<IfModule dir_module>
DirectoryIndex index.php index.html
</IfModule>
ErrorLog "logs/error_log"
LogLevel warn
<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
<IfModule logio_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
</IfModule>
CustomLog "logs/access_log" common
</IfModule>
<IfModule mime_module>
TypesConfig conf/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddType text/html .php
AddType application/x-httpd-php-source phps
AddHandler php5-script .php
</IfModule>
Include conf/extra/httpd-ssl.conf
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
<IfModule setenvif_module>
BrowserMatch "MSIE 10.0;" bad_DNT
</IfModule>
<IfModule headers_module>
RequestHeader unset DNT env=bad_DNT
</IfModule>
Timeout 60
StartServers 1
<IfModule prefork.c>
MinSpareServers 1
MaxSpareServers 1
</IfModule>
ServerLimit 256
MaxClients 25
MaxRequestsPerChild 80
KeepAlive On
KeepAliveTimeout 5
MaxKeepAliveRequests 30
.htaccess
Options -Indexes
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^HEAD
RewriteRule .* ~#~S[F]
RewriteCond %{DAV} !^$
RewriteRule . - [L]
Please help. Thanks in Advance.

Answer 1

I had the same problem and it was a false positive. I logged into my server with ssh, typed httpd -M to list modules loaded, and sent a screenshot of that session to the ASV to prove that dav modules were not loaded. The issue was closed.