CAPEC-193: PHP Remote File Inclusion
Description
In this pattern the adversary is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized include or require call, which the user can then control to point to any web-accessible file. This allows adversaries to hijack the targeted application and force it to execute their own instructions.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- Target application server must allow remote files to be included in the require, include, etc. PHP directives
- The adversary must have the ability to make HTTP requests to the target web application.
Skills required
- LowTo inject the malicious payload in a web page
- MediumTo bypass filters in the application
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- Authorization
Execute Unauthorized Commands
Run Arbitrary Code
- AccountabilityAuthenticationAuthorizationNon-Repudiation
Gain Privileges
- Access ControlAuthorization
Bypass Protection Mechanism
Mitigations
- Implementation: Perform input validation for all remote content, including remote and user-generated content
- Implementation: Only allow known files to be included (allowlist)
- Implementation: Make use of indirect references passed in URL parameters instead of file names
- Configuration: Ensure that remote scripts cannot be include in the include or require PHP directives