Local File Inclusion
Local File Inclusion Definition
Local file inclusion (LFI) is a web application vulnerability that lets an attacker force a website to load and expose a file that already exists on the local server. This flaw gives unauthorized users access to sensitive server-side data, such as configuration files or source code, and can sometimes provide a pathway to execute malicious code.
How LFI Works
Many web applications use local files to load templates, images, language files, or page content. Securely built applications decide which file to load on the server siwebpagede, but some instead take a filename straight from the user's request and add it to a server-side directory path, letting an attacker tamper with it. When the goal is executing arbitrary code, LFI typically targets dynamic file inclusion mechanisms such as include() and require() in Hypertext PreProcessor (PHP).
The vulnerability happens when the application trusts this input and uses the provided file name or path without validating it. Attackers manipulate the input to make the application look outside the intended directory and load a completely different local file.
The risk is server-side. A regular visitor sees only the standard web page, but the application itself operates with permissions to read restricted files. When attackers exploit an unchecked path, they can cause the server to reveal those hidden assets. They can then study how the site operates, map out hidden directories, and collect information to plan further attacks. If the included file contains attacker-controlled content, the application might even execute it, allowing the attacker to run their own commands directly on the server.
Common Targets and Impact of LFI
- Configuration files: LFI can expose database details, application settings, credentials, or other sensitive server-side information.
- Source code: Attackers may read application files to understand how the website works and look for more weaknesses.
- Log files: Because servers write request data like the User-Agent header into their logs, an attacker can inject PHP into a log entry, then include the log file so the interpreter runs the injected code. This makes logs a common path to code execution when no user-uploaded file is available.
- System files: LFI can expose operating system files if the web application has read access to them.
- Uploaded files: If the application includes a file that contains attacker-controlled content, LFI may help attackers move from file exposure to code execution.
How Websites Prevent LFI
Websites prevent LFI by avoiding user-controlled file paths wherever possible. Developers can map user choices to approved file identifiers, keep allowlists of safe files, and validate requested files before loading them. They should also block access to sensitive directories and use least-privilege permissions so the web application can only read files it genuinely needs.
Read More
FAQ
An LFI is a web application vulnerability that lets an attacker make a website load a file from its own server. This can expose sensitive files, application code, configuration details, or logs that the website shouldn’t make public.
LFI happens when an application uses user-controlled input to choose which local file to load. If the website doesn’t validate the file name or path properly, attackers may change the request so the server loads a file outside the intended folder.
LFI loads a file from the same server as the vulnerable application. Remote file inclusion (RFI) loads a file from an outside location. Both involve unsafe file inclusion, but RFI depends on the application accepting remote file paths.
Websites prevent LFI by avoiding direct user-controlled file paths. Developers can use approved file identifiers, allowlists, strict input validation, and least-privilege permissions. They should also block access to sensitive directories and protect configuration files, logs, and source files.
45-Day Money-Back Guarantee