Remote File Inclusion (RFI)

Description

During the scan, Kayran managed to find that an external, malicious files could be loaded.
That, might lead to Remote File Inclusion (RFI) attacks. The purpose of an RFI attack is stealing information from affected servers and taking over the site that allows content to be changed.

The attacker’s main purpose is to exploit the vulnerable mechanism found in the web application. He abuses it to upload malicious files from a remote URL located in another origin. (for example : backdoor shells)

This is an example of a PHP code that holds an RFI vulnerability. The following source code display what is occurring “behind the scenes” when a programmer writing a code holding RFI vulnerability :

<?php$page = $_POST['page'];

include($page);

?>

Recommendation

To prevent this vulnerability from occurring in the future, the user input must be verified and filtered correctly. Additionally, if the server is on Apache, make sure that allow_url_include is off so that it will not be possible to load content from any external URLs.

References

https://www.imperva.com/learn/application-security/rfi-remote-file-inclusion/

< Return to all Vulnerabilities

What is Kayran

Kayran scanner is helping all businesses, both SMBs and enterprises, to test their online assets and products for over 30,000+ vulnerabilities.Kayran’s mission is to make

Read More »

Blue Team

We’ve talked about The Red Team before, but what about The Blue Team? How is this group different from the red one? Why would we

Read More »

Servers 101

Let’s have a “quick” Servers 101 Course. Courtesy of Kayran! If you’ve been on the internet for over an hour, you probably already heard of

Read More »