Description
Local File Inclusion (LFI) is a vulnerability that allows attackers to include local files, exploiting dynamic file inclusion mechanisms in the target application. This occurs due to the use of user-supplied input without proper validation. The content of the local file is reflected in the response, and if containing code, it might be executed by the application.
Recommendation
To mitigate LFI vulnerabilities, avoid passing user-submitted input to filesystem/framework APIs. If unavoidable, maintain an allow list of files that may be included, using an identifier to access selected files. Reject any request with an invalid identifier to eliminate attack surface.
References
Could your website be exposed too?
SmartScanner can check your website for Local File Inclusion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Remote File Inclusion - Vulnerability
- Remote File Disclosure - Vulnerability
- Remote URL Inclusion - Vulnerability
- Gatsby develop server has Local File Inclusion vulnerability - CVE-2023-34238
