Difference in File Inclusion and File Upload vulnerability

[Saket Verma]

Hello nulls,

Can someone help me to understand difference between file inclusion and file upload vulnerability?

Thanks in advance.

[Rajesh A.]

http://en.wikipedia.org/wiki/File_inclusion_vulnerability

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file or more serious events such as:

Code execution on the web server
Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS)
Denial of service (DoS)
Data theft/manipulation


https://www.owasp.org/index.php/Unrestricted_File_Upload

Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step.

> --
> _______________________________________________________________________________
> null - Spreading the right Information
> null Mailing list charter: http://null.co.in/section/about/null_list_charter/
> ---
> You received this message because you are subscribed to the Google Groups "null" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to null-co-in+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.




--
Thank You.
Regards.
Rajesh A.

[Saket Verma]

@ Rajesh thanks for quick reply, but still your reply not making any sense to me.

File Inclusion Vulnerability has two types

1. LFI - including local file like /etc/passwd

2. RFI  - ?page=remote_file_path

and in file upload vulnerability,

lets say we upload shell.

But this can be done using RFI  also.

Can someone be specific for difference in file inclusion and upload vulnerability?

[Akash]

Saket,

The difference is in the code that is vulnerable. File upload vulnerability allows for uploading of files that can contain code to give you a web shell. File inclusion vulnerabilities allows for inclusion of a local or a remote file which then gets included as part of the same response and gets executed as code and give you an output.

Warm regards,
Akash Mahajan

That Web Application Security Guy | +91 99 805 271 82
akashm.com | @makash on twitter | linkd.in/webappsecguy
OWASP Bangalore Chapter Lead | null Community Manager

[Taher Saifuddin]

Saket,

You might want to think of it this way:

File inclusion is a vulnerability - There is a flaw in the application that allows users to include/inject files that are either already present on the server (LFI) or that can be downloaded from another location on the web (RFI). This may arise regardless of whether the developer actually intended users to upload/include files to the application.

FIle Upload - This is a legitimate functionality of an application which can be exploited if not implemented correctly as in the case of Unrestricted File Upload shared by R@J.

Hope this helps.

Regards,

Taher.

[Rajesh A.]

Sakat,

Please re-look in the your reply

"
File Inclusion Vulnerability has two types
1. LFI - including local file like /etc/passwd
2. RFI  - ?page=remote_file_path

and in file upload vulnerability,
lets say we upload shell.
and in file upload vulnerability,
lets say we upload shell.
But this can be done using RFI  also.
"

LFI -> You are reading/executing a file on/from the server hosting vul.app. (This can be a file that you uploaded using file upload vulnerability or one file residing on the server like passwd )

RFI - You are using a file from another server not from the vul. server.

You can not upload a file using RFI like the upload vulnerability. File upload vul. you can upload a file to the server hosting the vulnerable app.

If this makes ur understanding more complicated - plz wait for some one else to answer :)

[Nishant Das Patnaik]

Hi Saket,

With a arbitrary file upload vulnerability you can do couple of things:

1. Remote Code Execution

2. File Hosting Server.

If you are interested for RCE, you need to make sure:

1. You are able to upload the file in a format that ensure the file can be actually executed, uploading a PHP script by renaming as a ZIP doesn't make any sense unless the ZIP is a defined as a CGI handler, or in other words ZIP is not "associated" with the PHP to be executed. 

2. The directory where you are able to upload the file must have execute permissions for the current user/group or at least you are able to move it to a directory that meets the requirements, often not the case.

3. You must be able to predict the exact path of the file you just uploaded.

Now remote file inclusion is you dont need anything to upload, the malicious script remains on your server and from the above you dont need point. 2 and 3 to be true. If you are wondering how this possible watch this real world video that I created about 1 year ago. The issue has been fixed for more than 1 year now. The link is here: https://www.dropbox.com/s/m6apc4yooar5rdg/dominos-remote-code-exec.mov?dl=0

Thanks

Nishant

[G0tD4un1k]

Hello Saket,

Had been listening to your question, repiles from Null members and your response mentioning it does not make sense to you.

Do you mind mentioning your understanding of File inclusion and file upload vulnerability? If you have any confusion on top of it we will try to address it.

In nut shell here is the response:

File Inclusion: File inclusion vulnerability is when an attacker is able to do LFI or RFI

File Upload: File upload vulnerability is when an attacker is able to upload a file to the target system. Once uploaded LFI can be one of the vectors to exploit it.

Cheers
G0tD4un1k

[Saket Verma]

Hi,

I was also performing it practically on other web apps, and now Im good.

thanks @akash, @rajesh, @Nishant your replies made it perfectly clear.

--