Home / Knowledge hub / Remote file inclusion
Knowledge hub
Remote file inclusion
Making an app load and run code from an address the attacker controls.
What it means
Remote file inclusion, or RFI, is when an application builds the name of a file to load from user input and the runtime is willing to fetch that file from another server. The attacker supplies the address of their own file, and the application loads it as if it were part of the site.
Where the loaded file is code, the application runs it. The attacker never has to upload anything to your server; they only need your application to reach out and fetch it. The attacker controls the content, the timing and the address, so a single parameter can hand them your server.
Why it matters
The result is remote code execution under the web server's identity. From there an attacker can read configuration and databases, change pages, install a backdoor or use the machine to attack others. MITRE tracks the PHP form as CWE-98. It is rated critical for good reason.
RFI is less common than it was, because current runtimes disable remote includes by default. Where it still occurs, it tends to be in old applications or in servers where that setting was switched on to make something work, and then forgotten.
How it shows up
You meet it in older PHP pages that include a file named in a parameter, and in settings such as allow_url_include. Other ecosystems have equivalents, such as scripts or templates loaded from a user-supplied address. The common mistake is leaving remote includes enabled when the application does not need them.
Turn off remote includes in the runtime, never pass user input to include or require statements, and map a short list of names to local files with an allowlist. Block outbound requests the server does not need. Test by pointing include parameters at an address you control and watching for a request. See local file inclusion and remote code execution.
Questions people ask
Remote file inclusion, answered
How is remote file inclusion different from local file inclusion?
Local inclusion loads a file already on your server. Remote inclusion loads a file from somewhere else, which gives the attacker full control over what runs.
Both come from the same cause: letting input choose the file.
Is RFI still a risk?
Less than before, because remote includes are off by default in modern PHP. It still appears in old applications and misconfigured servers.
It is worth ruling out, as the impact is so high.
Is RFI the same as SSRF?
No. In SSRF your server makes a request to an address and returns or acts on the response. In RFI your server loads the fetched content as code.
Both involve a server fetching from an address supplied by someone else.
What settings reduce RFI risk?
Disable remote file includes in the runtime, restrict outbound network access from the web server, and run it with minimal permissions.
Avoid dynamic include statements altogether. Review these settings after every server upgrade.
How do we test for RFI?
Replace file or page parameters with an address you control and see whether your server requests it.
A request arriving at your test server is proof the application fetched it.
Related
Terms that sit next to this one
Local file inclusion
Making an app read and show a file from its own server that it should not.
Remote code execution
Getting a server to run commands of an attacker's choosing.
SSRF
Making your server fetch a URL of the attacker's choosing.
Path traversal
Using a crafted file name to reach files outside the intended folder.
Egress filtering
Limiting what your servers may connect out to, which blunts data theft.
Will your app fetch and run it?
Old include statements can hand control to a stranger's file. We test the parameters that choose files and report what your server fetched or ran, with proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.