Local File Inclusion (LFI)

How Local File Inclusion (LFI) Works

LFI vulnerabilities occur when applications dynamically include files based on user-controlled input without proper validation. The most common context is PHP applications that use include(), require(), include_once(), or require_once() with user-supplied filenames. When an attacker controls the filename passed to these functions, they can include any readable file on the server. The critical difference from path traversal is that inclusion can mean execution — if the included file contains valid PHP code (even embedded within other content like logs), that code will be executed by the PHP interpreter with the application's full privileges.

Real-World Examples

Impact & Risk Assessment

Local file inclusion is rated Critical because it frequently escalates from file reading to full remote code execution. The immediate impact includes reading sensitive configuration files (database credentials, API keys, encryption secrets), application source code, system files (/etc/shadow for password hashes), and private keys. When escalated to code execution via log poisoning, PHP wrappers, or uploaded file inclusion, the attacker gains the ability to execute arbitrary commands with the web server's privileges, typically resulting in complete server compromise. In containerized environments, LFI can expose environment variables containing secrets, Kubernetes service account tokens, and cloud metadata credentials. The prevalence of LFI in PHP applications (which power approximately 77% of all websites) makes it one of the most commonly exploited web vulnerabilities.

How to Detect Local File Inclusion (LFI)

Monitor request parameters for file inclusion indicators: directory traversal sequences (../, ..\), PHP wrapper prefixes (php://, data://, zip://, phar://), null bytes (%00), and references to known sensitive files (/etc/passwd, /proc/self/environ, win.ini). Analyze web server logs for suspicious User-Agent strings containing PHP code (log poisoning indicator). Implement file integrity monitoring on web server log files and session directories — unexpected PHP tags in these files indicate active exploitation. Deploy application-level logging that records all file include/require operations with the resolved file path, flagging any path that falls outside the application's expected directory structure. WAF rules should detect encoded variants of traversal sequences and wrapper syntax. Runtime application self-protection (RASP) can intercept file operations in real-time, blocking includes of files outside the whitelist.

How to Prevent Local File Inclusion (LFI)

Never use user input directly in file inclusion functions. Implement an allowlist of permitted files/modules and map user input to the allowlist via a lookup table (e.g., switch/case or dictionary mapping ?page=home to templates/home.php) rather than using the input as a filename. If dynamic file inclusion is required, resolve the canonical path and verify it falls within the expected base directory. Disable dangerous PHP settings: allow_url_include=Off (prevents remote file inclusion), open_basedir to restrict file access to the application directory, and disable_functions for system(), exec(), passthru(). Use a modern framework that abstracts file inclusion behind safe template rendering (Twig, Blade, Jinja2). Keep PHP and all server-side frameworks updated to patch known LFI vulnerabilities. Deploy a WAF with LFI-specific rules covering traversal patterns, PHP wrappers, and null byte injection. In containerized deployments, apply read-only file systems where possible and minimize the files accessible to the application process.

Code Examples

<?php
// VULNERABLE: User input directly used in include
$page = $_GET['page'];
include("pages/" . $page . ".php");

// Attacker: ?page=../../../../etc/passwd%00
// Result: includes /etc/passwd (null byte truncates .php on old PHP)

// Attacker: ?page=php://filter/convert.base64-encode/resource=config
// Result: Leaks config.php source code as base64

// Attacker: ?page=../../../../var/log/apache2/access.log
// After poisoning User-Agent with: <?php system($_GET['cmd']); ?>
// Result: Remote code execution via log poisoning
?>

<?php
// SECURE: Map user input to allowed files via allowlist
$allowed_pages = [
    'home'     => 'pages/home.php',
    'about'    => 'pages/about.php',
    'contact'  => 'pages/contact.php',
    'products' => 'pages/products.php',
    'faq'      => 'pages/faq.php',
];

$page = $_GET['page'] ?? 'home';

// Strict allowlist lookup — no file path manipulation possible
if (!array_key_exists($page, $allowed_pages)) {
    http_response_code(404);
    include('pages/404.php');
    exit;
}

include($allowed_pages[$page]);
?>

import re
import os
from functools import wraps

# LFI attack patterns
LFI_PATTERNS = [
    r'\.\.[\/\\]',                 # Directory traversal
    r'%2e%2e[%2f%5c]',              # URL-encoded traversal
    r'%252e%252e',                   # Double-encoded traversal
    r'php:\/\/',                     # PHP wrapper
    r'data:\/\/',                    # Data wrapper
    r'zip:\/\/',                     # Zip wrapper
    r'phar:\/\/',                    # Phar wrapper
    r'expect:\/\/',                  # Expect wrapper
    r'%00',                          # Null byte
    r'\/etc\/(passwd|shadow|hosts)', # Known sensitive files
    r'\/proc\/self',                 # Process info
    r'\/(var|tmp)\/log',            # Log files
    r'web\.config',                  # IIS config
    r'\.htaccess',                   # Apache config
]

def detect_lfi(request_params):
    """Check request parameters for LFI indicators"""
    compiled = [re.compile(p, re.IGNORECASE) for p in LFI_PATTERNS]
    
    for param_name, param_value in request_params.items():
        decoded = urllib.parse.unquote(urllib.parse.unquote(param_value))
        for pattern in compiled:
            if pattern.search(decoded):
                return {
                    'detected': True,
                    'parameter': param_name,
                    'value': param_value,
                    'pattern': pattern.pattern
                }
    return {'detected': False}

def safe_file_resolve(base_dir, user_input):
    """Safely resolve a file path within a base directory"""
    # Reject any path separators in user input
    if os.sep in user_input or '/' in user_input or '\\' in user_input:
        raise ValueError('Invalid filename: path separators not allowed')
    
    # Resolve canonical path
    resolved = os.path.realpath(os.path.join(base_dir, user_input))
    base_resolved = os.path.realpath(base_dir)
    
    # Verify resolved path is within base directory
    if not resolved.startswith(base_resolved + os.sep):
        raise ValueError('Access denied: path outside base directory')
    
    if not os.path.isfile(resolved):
        raise FileNotFoundError('File not found')
    
    return resolved

Frequently Asked Questions

Related Attacks