Method and system for detection of remote file inclusion vulnerabilities
View Patent ↗A method for detecting remote file inclusion vulnerabilities in a web application includes altering of extracted resource references from a web application, submission of altered references as HTTP requests to the web application, inspection of corresponding HTTP responses, and diagnosis of vulnerability. A computer system or systems can implement the disclosed embodiments.
1. A method for identifying a vulnerability of a web application, comprising:
extracting a resource reference from a web application hosted on a web server;
altering the extracted reference to include an altered reference, the altered reference referring to a remote file containing program code, wherein the remote file is an entry in a repository external to the web server;
sending the altered reference to the web application;
providing the repository at a network location accessible to the web server, the network location corresponding to the altered reference; and
determining if a response from the web application contains at least one signature corresponding to the entry in the repository,
wherein the repository is a relational database.
2. The method of claim 1 , further comprising determining from the response that the web application executed at least a portion of the program code from the remote file.
3. The method of claim 2 , further comprising identifying a type of program interpreter that executed at least a portion of the program code from the remote file.
4. The method of claim 1 , further comprising identifying an injection point of the web application to be utilized in the act of sending the altered reference to the web application.
5. The method of claim 1 , wherein the act of sending the altered reference to the web application comprises constructing an HTTP request having the altered reference.
6. The method of claim 1 further comprising:
repeating altering the extracted reference for referencing each of a plurality of entries in the repository.
7. A non-transitory computer readable medium comprising executable instructions stored thereon for identifying a vulnerability of a web application, the instructions to cause one or more processors to:
extract a resource reference from a web application hosted on a web server;
alter the extracted reference to include an altered reference, the altered reference referring to a remote file containing program code, wherein the remote file is one of a plurality of entries in a repository external to the web server;
send the altered reference to the web application;
provide the repository at a network location accessible to the web server, the network location corresponding to the referenced entry in the repository; and
determine if a response from the web application contains one or more signatures that correspond to the referenced entry in the repository indicating vulnerability of the web application,
wherein the repository is a relational database.
8. The non-transitory computer readable medium of claim 7 , further comprising instructions to cause the one or more processors to determine from the response that the web application executed at least a portion of the program code from the remote file.
9. The non-transitory computer readable medium of claim 8 , further comprising instructions to cause the one or more processors to identify a type of program interpreter that executed at least a portion of the program code from the remote file.
10. The non-transitory computer readable medium of claim 7 , further comprising instructions to cause the one or more processors to identify an injection point of the web application to be utilized in the act of sending the altered reference to the web application.
11. The non-transitory computer readable medium of claim 7 , wherein the instructions to cause the one or more processors to send the altered reference to the web application comprise instructions to cause the one or more processors to construct an HTTP request having the altered reference.
12. The non-transitory computer readable medium of claim 7 , further comprising instructions to:
repeat altering the extracted reference for referencing each of a plurality of entries in the repository.
13. A computer system configured to identify a vulnerability of a web application, the computer system comprising:
a network interface; and
one or more processors coupled to the network interface, wherein the one or more processors are configured to:
extract, via the network interface, a resource reference from a web application hosted on a web server;
alter the extracted resource reference to include an altered reference, the altered reference referring to a remote file containing program interpreted code, wherein the remote file is an entry of a plurality of entries in a repository external to the web server;
send, via the network interface, the altered reference to the web application;
provide the repository at a network location accessible to the web server; and
determine from a response received from the web application whether the web application remotely included the remote file,
wherein the repository is a relational database.
14. The computer system of claim 13 , wherein the one or more processors are further configured to determine whether the web application remotely included the remote file by inspecting the response for a unique signature.
15. The computer system of claim 13 , wherein the one or more processors are further configured to determine from the response that the web application executed at least a portion of the program code from the remote file.
16. The computer system of claim 13 , wherein the one or more processors are further configured to send the altered reference to the web application by constructing an HTTP request having the altered reference.