Local File Inclusion
Introduction
Local File Inclusion (LFI) allows an attacker to include files on a server through the web browser. This vulnerability exists when a web application includes a file without correctly sanitising the input, allowing and attacker to manipulate the input and inject path traversal characters and include other files from the web server.
How to Test
Any script that includes a file from a web server is a good candidate for further LFI testing, for example:
Hacker would attempt to exploit this vulnerability by manipulating the file location parameter, such as:
The above is an effort to display the contents of the /etc/passwd file on a UNIX / Linux based system.
Null Byte Technique
Null byte injection bypasses application filtering within web applications by adding URL encoded “Null bytes” such as %00. Typically, this bypasses basic web application blacklist filters by adding additional null characters that are then allowed or not processed by the backend web application.
Some practical examples of null byte injection for LFI:
Proc/self/environ
If the server is outdated then to exploit it through LFI we can include proc/self/environ file that stores User_Agent where we will place our PHP code for executing CMD command.
Add cmd comment <?php system($_GET[‘cmd’]); ?>inside user_Agent and send the request with GET parameter and add cmd=idin the url.
How to Fix
So, the easiest way to prevent Local File inclusion vulnerabilities is to set the value of “allow_url_include” to “Off” in PHP configuration file. You can disable allow_url_include from php.ini or .htaccess.
php.ini
allow_url_include = 'off'
.htaccess
php_flag allow_url_include off
If possible, do not permit file paths to be appended directly. Make them hard-coded or selectable from a limited hard-coded path list via an index variable.
If you definitely need dynamic path concatenation, ensure you only accept required characters such as "a-Z0-9" and do not allow ".." or "/" or "%00" (null byte) or any other similar unexpected characters.
It's important to limit the API to allow inclusion only from a directory and directories below it. This ensures that any potential attack cannot perform a directory traversal attack.
References
Last updated
Was this helpful?
