Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I guess the title says it all. There seems to be no obvious difference between directory traversal and file inclusion vulnerabilities.

But I guess there must be some difference, since the www.cvedetails.com use the following categorizations:

 Bypass a restriction or similar 
 Cross Site Scripting 
 Denial of service 
 Directory Traversal 
 Execute arbitrary code on vulnerable system 
 Gain Privileges
 Http Response Splitting 
 Memory Corruption 
 Obtain information 
 Overflow vulnerability (includes stack and heap based overflows and other overflows) 
 Cross site request forgery(CSRF) 
 File Inclusion 
 Sql Injection

Among these we can notice both directory traversal and file inclusion, so they must be different somehow.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Basically, the difference is that with a file inclusion vulnerability, the resource is loaded and executed in the context of the current application. A directory traversal vulnerability on the other hand, only gives you the ability to read the resource.

share|improve this answer
    
Thanks for the answer, which is exactly what I need. But then again, I'm still confused: let's look at the following URL: exploit-db.com/exploits/16250 . It says there that it's a file inclusion vulnerability, but based on your answer it's a directory traversal, since it only allows us to read the file, not actually execute it. Any ideas why? –  eleanor Feb 18 '12 at 11:19
    
Also remember that other people are having the same questions you have, and there really is no one authority for vulnerability definitions, risk scoring, etc. While that is listed, by the reporter, as a LFI, I would still consider it a directory traversal. Compare these results: cvedetails.com/vulnerability-list/year-2011/opfileinc-1/… and cvedetails.com/vulnerability-list/year-2011/opdirt-1/… –  Gerry Feb 18 '12 at 15:47
    
Thank you, that completely answers my question. –  eleanor Feb 18 '12 at 18:53
add comment

Example files:

  • File A is ../../../../configure.php

  • File B is index.php

There is a difference between being able to traverse up directories to access file A ( for example ) to read its contents, and that of being able to include the contents of file A, whether hosted locally or remotely, into the page execution of another file.

If a directory traversal existed to give the attacker access to file A, they should at least not be able to read the content of it. However if File B has this line in it ( or similar ):

if ( isset( $_GET[ 'id' ] ) ) include( $_GET[ 'id' ] . ".php" );

Then it is possible to have the content of file A included in base64 encoding, into file B in what is called a Local File Inclusion attack.

index.php?id=php://filter/read=convert.base64-encode/resource=../../../../config

That is how I understand the difference to be.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.