Local file inclusion
Description
The application allows to read or execute files located on the server through relative paths manipulation in the input fields.
Impact
- Visualize the content of sensitive files stored on the server.
- Get sensitive data.
- Read system files.
Recommendation
- Validate that the parameters received by the application do not contain relative paths.
- Disable insecure functions that allow reading of arbitrary files on the server.
Threat
Unauthorized attacker from local network.
Expected Remediation Time
โ 120 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: N
- User interaction: N
- Scope: C
- Confidentiality: H
- Integrity: N
- Availability: N
Temporal
- Exploit code madurity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:X/RL:X/RC:X
- Score:
- Base: 8.6
- Temporal: 8.6
- Severity:
- Base: High
- Temporal: High
Code Examples
Compliant code
All input parameters are validated to ensure they do not contain relative routes
private String getFile(userReq){
try {
//Function to validate that parameter does not contain relative routes
isValidReq = validateReq(userReq)
//Read files from a remote direction not local
if (isValidReq){
File file = new File(classLoader.getResource("secureurl").getFile());
//Code to do something with that file
}
}catch{
...
}
}
Non compliant code
The application includes a reference to a local path that could be altered by the user
private String getLocalFile( userReq){
try {
Path = "/localPath/" + userReq
File file = new File(classLoader.getResource(Path).getFile());
//Code to do something with that file
}catch{
...
}
}