237
Nature Type ID Name Page
ChildOf 706 Use of Incorrectly-Resolved Name or Reference 1544
ChildOf 829 Inclusion of Functionality from Untrusted Control Sphere 1741
CanAlsoBe 426 Untrusted Search Path 1028
CanFollow 73 External Control of File Name or Path 132
CanFollow 184 Incomplete List of Disallowed Inputs 459
CanFollow 425 Direct Request ('Forced Browsing') 1025
CanFollow 456 Missing Initialization of a Variable 1089
CanFollow 473 PHP External Variable Modification 1127
CanPrecede 94 Improper Control of Generation of Code ('Code Injection') 219
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Applicable Platforms
Language : PHP (Prevalence = Often)
Alternate Terms
Remote file include :
RFI : The Remote File Inclusion (RFI) acronym is often used by vulnerability researchers.
Local file inclusion : This term is frequently used in cases in which remote download is disabled,
or when the first part of the filename is not under the attacker's control, which forces use of relative
path traversal (CWE-23) attack techniques to access files that may contain previously-injected PHP
code, such as web access logs.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
The attacker may be able to specify arbitrary code to be
executed from a remote location. Alternatively, it may be
possible to use normal program behavior to insert php
code into files on the local machine which can then be
included and force the code to execute since php ignores
everything in the file except for the content between php
specifiers.
Detection Methods
Manual Analysis
Manual white-box analysis can be very effective for finding this issue, since there is typically a
relatively small number of include or require statements in each program.
Effectiveness = High
Automated Static Analysis
The external control or influence of filenames can often be detected using automated static
analysis that models data flow within the product. Automated static analysis might not be able
to recognize when proper input validation is being performed, leading to false positives - i.e.,
warnings that do not have any security consequences or require any code changes. If the
program uses a customized input validation library, then some tools may allow the analyst to
create custom signatures to detect usage of those routines.
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion') 238
Potential Mitigations
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid.
Phase: Architecture and Design
Strategy = Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a
mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs,
and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to
"profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Phase: Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are
duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side
checks by modifying values after the checks have been performed, or by changing the client to
remove the client-side checks entirely. Then, these modified values would be submitted to the
server.
Phase: Architecture and Design
Phase: Operation
Strategy = Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between
the process and the operating system. This may effectively restrict which files can be accessed
in a particular directory or which commands can be executed by the software. OS-level examples
include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide
some protection. For example, java.io.FilePermission in the Java SecurityManager allows the
software to specify restrictions on file operations. This may not be a feasible solution, and it
only limits the impact to the operating system; the rest of the application may still be subject to
compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Effectiveness = Limited
The effectiveness of this mitigation depends on the prevention capabilities of the specific
sandbox or jail being used and might only help to reduce the scope of an attack, such as
restricting the attacker to certain system calls or limiting the portion of the file system that can be
accessed.
Phase: Architecture and Design
Phase: Operation
Strategy = Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks
[REF-76]. If possible, create isolated accounts with limited privileges that are only used for a
single task. That way, a successful attack will not immediately give the attacker access to the
rest of the software or its environment. For example, database applications rarely need to run as
the database administrator, especially in day-to-day operations.
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion')