What is File Inclusion
File Inclusion in php
Many modern web scripting languages enable code re-use and modularization through the ability to include additional source files within one encapsulating file. This ability is often used to apply a standard look and feel to an application (templating), share functions without the need for compiled code, or break the code into smaller more manageable files. Included files are interpreted as part of the parent file and executed in the same manner. File inclusion vulnerabilities occur when the path of the included file is controlled by unvalidated user input.
File inclusion vulnerabilities are one of the most prolific and severe vulnerabilities in PHP applications. Prior to PHP 4.2.0, PHP installations shipped with the register_globals option enabled by default, which permits attackers to easily overwrite internal server variables. Although disabling register_globals can limit a program's exposure to file inclusion vulnerabilities, these problems still occur in modern PHP applications.
Example 1: The following code includes a file under the application defined $server_root in a template.
...
<?php include($server_root . '/myapp_header.php'); ?$gt;
...If register_globals is set to on, an attacker may overwrite the $server_root value by supplying $server_root as a request parameter, thereby taking partial-control of the dynamic include statement.
Example 2: The following code takes a user specified template name and includes it in the PHP page to be rendered.
...
<?php include($_GET['headername']); ?$gt;
...In Example 2, an attacker may take complete control of the dynamic include statement by supplying a malicious value for headername that causes the program to include a file from an external site.
If the attacker specifies a valid file to a dynamic include statement, the contents of that file will be passed to the PHP interpreter. In the case of a plaintext file, such as /etc/shadow, the file might be rendered as part of the HTML output. Worse, if the attacker may specify a path to a remote site controlled by the attacker, then the dynamic include statement will execute arbitrary malicious code supplied by the attacker.
Explanation :
Here the file admin_fns.php passes an unvalidated filename to a dynamic include statement on line 30. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution.
Recommendation
Disable the register_globals option by including the following line in php.ini:
register_globals = 'off'Do not allow unvalidated user input to control paths used in dynamic include statements. Instead, use a level of indirection: create a list of legitimate files for inclusion, and only allow users to select from the list. With this approach, the user can not directly specify a file from the file system.
Example 2 could be improved to map user input to a key that selects the desired template, as follows:
<?php
$templates = array('main.php' => 1, 'blue.php' => 2, 'red.php' => 3);
?$gt;
...
<?php include($templates[$_GET['headername']]); ?$gt;...
Tips
1. Due to the dynamic nature of PHP, you may see a large number of findings in PHP library files. Consider using a filter file to hide specific findings from view. For instructions on creating a filter file, see Advanced Options in the Fortify Static Code Analyzer User Guide
