Coders Conquer Security: Share & Learn Series - Remote File Inclusion
Coders Conquer Security: Share & Learn Series - Remote File Inclusion
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/6022b6bf48ac1fe26e9eee60_5fed09625ceaed94d8d9e636_SCW-Coders-Conquer-badge-BANNER-1.jpeg)
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/6022b6bf48ac1fe26e9eee60_5fed09625ceaed94d8d9e636_SCW-Coders-Conquer-badge-BANNER-1.jpeg)
Those of you reading this blog series might notice a lot of similarities between the remote file inclusion vulnerability and the local file inclusion and path traversal vulnerability discussed previously. Their root causes are similar, as are the recommended fixes.
In many ways, the remote file inclusion vulnerability is much more dangerous, and also easier to exploit, than its local file counterpart. As such, it should be found and remedied as soon as possible. Or better yet, web applications should be designed in such a way as to prevent it from occurring in the first place.
In this episode, we will learn:
- How hackers exploit the remote file inclusion vulnerability
- Why allowing remote file inclusion is dangerous
- Techniques that can fix this problem.
How do Attackers Exploit Remote File Inclusion?
The remote file inclusion vulnerability takes advantage of the "dynamic file include" command or mechanism that exists in most programming frameworks. The ability is intended to allow developers to use files located on a secondary server to execute activities on the application server. Obviously, this can be dangerous in the wrong hands.
How attackers exploit this ability is by finding any website or application that allows uncontrolled user input, which can come from things like HTTP headers or input areas in interactive forms. They use that as a launching point to generate file include commands.
For example, if a site uses the GET function to load pages, such as page = request.getParameter("page'); include page; then an attacker could send in a query using the page command, but with a URL of a site they control and file path to the file they want to execute. The query then gets passed to the server and the remote file is executed on the host. The activity is allowed because it is now part of the trusted app.
Why is the Remote File Inclusion Vulnerability Dangerous?
The level of danger posed by remote file inclusion is extremely high. Unlike with local file inclusion vulnerabilities, where files an attacker runs must exist on a host, and also be found by the attacker using trial and error, there are no restrictions like that with remote file inclusion. Obviously, an attacker knows the location of the files they want to exploit since they likely exist on their own machines, or sites they control. The files can also be hand chosen by them, and don't need to exist on the target machine prior to the exploit. The file might even consist of scripts specifically written to exploit a remote host.
In short, once an attacker is able to find and exploit a remote file inclusion vulnerability, there is nothing to stop them from gaining total control over an application or even an entire site. Certainly, no data stored there will be safe from their incursion.
Removing Remote File Inclusion Vulnerability
Never allow user input to pass directly to a file inclusion command for execution. Instead, use an indirect reference map of commands and only execute commands from there. An indirect reference map maps untrusted user input to a set of hardcoded trusted values on the server. Be sure to whitelist any areas where users can input data, and don't forget to include HTTP headers, form parameters and even cookies in that list. Doing that will close any window that an attacker looking to create a file include command can use.
As a bonus, proper sanitization and validation of user-generated content and employing reference maps to execute commands will not only squash the remote file inclusion vulnerability, but quite a few others as well, including this bug's dangerous cousin, the local file inclusion and path traversal exploit.
More Information about Remote File Inclusion
For further reading, you can take a look at the OWASP reference guide for remote file inclusion exploits. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.
Resources to get you started
Trust Agent by Secure Code Warrior
Discover SCW Trust Agent, an innovative solution designed to enhance security by aligning developer secure code knowledge and skills with the work they commit. It provides comprehensive visibility and controls across an organization's entire code repository, analyzing each commit against developers' secure code profiles. With SCW Trust Agent, organizations can strengthen their security posture, optimize development lifecycles, and scale developer-driven security.
Resources to get you started
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
SCW Trust Agent - Visibility and Control to Scale Developer Driven Security
SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.
Coders Conquer Security: Share & Learn Series - Remote File Inclusion
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/6022b6bf48ac1fe26e9eee60_5fed09625ceaed94d8d9e636_SCW-Coders-Conquer-badge-BANNER-1.jpeg)
Those of you reading this blog series might notice a lot of similarities between the remote file inclusion vulnerability and the local file inclusion and path traversal vulnerability discussed previously. Their root causes are similar, as are the recommended fixes.
In many ways, the remote file inclusion vulnerability is much more dangerous, and also easier to exploit, than its local file counterpart. As such, it should be found and remedied as soon as possible. Or better yet, web applications should be designed in such a way as to prevent it from occurring in the first place.
In this episode, we will learn:
- How hackers exploit the remote file inclusion vulnerability
- Why allowing remote file inclusion is dangerous
- Techniques that can fix this problem.
How do Attackers Exploit Remote File Inclusion?
The remote file inclusion vulnerability takes advantage of the "dynamic file include" command or mechanism that exists in most programming frameworks. The ability is intended to allow developers to use files located on a secondary server to execute activities on the application server. Obviously, this can be dangerous in the wrong hands.
How attackers exploit this ability is by finding any website or application that allows uncontrolled user input, which can come from things like HTTP headers or input areas in interactive forms. They use that as a launching point to generate file include commands.
For example, if a site uses the GET function to load pages, such as page = request.getParameter("page'); include page; then an attacker could send in a query using the page command, but with a URL of a site they control and file path to the file they want to execute. The query then gets passed to the server and the remote file is executed on the host. The activity is allowed because it is now part of the trusted app.
Why is the Remote File Inclusion Vulnerability Dangerous?
The level of danger posed by remote file inclusion is extremely high. Unlike with local file inclusion vulnerabilities, where files an attacker runs must exist on a host, and also be found by the attacker using trial and error, there are no restrictions like that with remote file inclusion. Obviously, an attacker knows the location of the files they want to exploit since they likely exist on their own machines, or sites they control. The files can also be hand chosen by them, and don't need to exist on the target machine prior to the exploit. The file might even consist of scripts specifically written to exploit a remote host.
In short, once an attacker is able to find and exploit a remote file inclusion vulnerability, there is nothing to stop them from gaining total control over an application or even an entire site. Certainly, no data stored there will be safe from their incursion.
Removing Remote File Inclusion Vulnerability
Never allow user input to pass directly to a file inclusion command for execution. Instead, use an indirect reference map of commands and only execute commands from there. An indirect reference map maps untrusted user input to a set of hardcoded trusted values on the server. Be sure to whitelist any areas where users can input data, and don't forget to include HTTP headers, form parameters and even cookies in that list. Doing that will close any window that an attacker looking to create a file include command can use.
As a bonus, proper sanitization and validation of user-generated content and employing reference maps to execute commands will not only squash the remote file inclusion vulnerability, but quite a few others as well, including this bug's dangerous cousin, the local file inclusion and path traversal exploit.
More Information about Remote File Inclusion
For further reading, you can take a look at the OWASP reference guide for remote file inclusion exploits. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.
Resources to get you started
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
SCW Trust Agent - Visibility and Control to Scale Developer Driven Security
SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.
Trust Agent by Secure Code Warrior
Discover SCW Trust Agent, an innovative solution designed to enhance security by aligning developer secure code knowledge and skills with the work they commit. It provides comprehensive visibility and controls across an organization's entire code repository, analyzing each commit against developers' secure code profiles. With SCW Trust Agent, organizations can strengthen their security posture, optimize development lifecycles, and scale developer-driven security.