Local / remote file inclusion
Attacker-chosen local or remote files included into server-side execution
categoryWeb and application attacksseverityVery Highlabnot yet measured
Classification
17 values: 10 reviewed, 6 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Software vulnerabilities |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Medium |
| Likelihood / prevalence | Medium |
| Maturity | Commoditized |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Environment | CloudOn-premises |
| Target asset class | ServerWeb app / API |
Detection & response
No linked mitigations or detections yet.
Framework references
- Primary source: https://capec.mitre.org/data/definitions/152.html
- cwe: CWE-98 (primary)
- capec: CAPEC-175
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Web and application attacks' table, line 247 of Cyber-Attack-Taxonomy.md
- ev-0002 (CAPEC — Common Attack Pattern Enumeration and Classification 3.9) — CAPEC-175 Code Inclusion: CAPEC prerequisites for this pattern
The target application must include external code/libraries that are executed when the application runs and the adversary must be able to influence the specific files that get included. | The victim must run the targeted application, possibly using the crafted parameters that the adversary uses to identify the code to include.
- ev-0003 (MITRE Common Weakness Enumeration (CWE) 4.20) — Linked to CWE-98 'Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')', a CWE Variant-level weakness (CWE 4.20).
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')