Local file inclusion to RCE

Question

Here is the code:

<?php
$file=trim($_GET['img_name']);
//echo $file;

if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);
    exit;
}
?>

Is there any possibility of RCE? I am a web developer and developing a website for my client.

Answer 1

Yes, it is possible e.g. using php wrappers.

A simple RCE could be done like this :

https://yoursite.com/?img_name=expect://ls

Note: This will work only if php configuration allow wrappers.

More details here : https://highon.coffee/blog/lfi-cheat-sheet/

Edit: You might need to URL encode the payload :

https://yoursite.com/?img_name=expect%2E%2F%2Fls

Answer 2

You should check for directory traversal and for file type for the requested file.

Directory traversal:

Use realpath() function

<?php
chdir('/var/www/');
echo realpath('./../../etc/passwd') . PHP_EOL;

echo realpath('/tmp/') . PHP_EOL;
?>

File type

$allowed =  array('gif','png' ,'jpg');
$filename = $_FILES['video_file']['name'];
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if(!in_array($ext,$allowed) ) {
    echo 'Invalid file type requested only images are allowed!';
}

RCE is not in any way possible with only this method.