Include injections occur in an application when the application retrieves data from a user or a third-party service and inserts it into an
include expression without sanitizing it first.
If an application contains an include expression that is vulnerable to injections, it is exposed to attacks that target the underlying
server.
What is the potential impact?
A user with malicious intent can create requests that will cause the include expression to leak valuable data or achieve remote code
execution on the server’s website.
After creating the malicious request, the attacker can attack the servers affected by this vulnerability without relying on any prerequisites.
The impact depends on the access control measures taken on the target system OS. In the worst-case scenario, the process runs with root privileges,
and therefore any OS commands or programs may be affected.
Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the vulnerability.
Denial of service and data leaks
In this scenario, the attack aims to disrupt the organization’s activities and profit from data leaks.
An attacker could, for example:
- download the internal server’s data, most likely to sell it
- modify data, send malware
- stop services or exhaust resources (with fork bombs for example)
This threat is particularly insidious if the attacked organization does not maintain a disaster recovery plan (DRP).
Root privilege escalation and pivot
In this scenario, the attacker can do everything described in the previous section. The difference is that the attacker also manages to elevate
their privileges to an administrative level and attacks other servers.
Here, the impact depends on how much the target company focuses on its Defense In Depth. For example, the entire infrastructure can be compromised
by a combination of OS injections and misconfiguration of:
- Docker or Kubernetes clusters
- cloud services
- network firewalls and routing
- OS access control
