logo

Database

Local file inclusion

Need

Prevention of unauthorized access to sensitive files on the server

Context

• Usage of C# for building robust and scalable applications

• Usage of System.IO for Input/Output operations in .NET development

• Usage of Microsoft.AspNetCore.Mvc for building web applications using the MVC architectural pattern

Description

1. Non compliant code

using System.IO;
using Microsoft.AspNetCore.Mvc;

public class FileController : Controller
{
    public IActionResult Index(string fileName)
    {
        return Content(file);...

The above code is an example of a Local File Inclusion (LFI) vulnerability. The `Index` action in `FileController` takes a `fileName` parameter from the user and uses it to read a file from the server's file system. This file's content is then returned in the HTTP response. This is vulnerable because a malicious user can manipulate the `fileName` parameter to read any file on the server. For example, they could provide a relative path like `../../etc/passwd` to read a sensitive file. The vulnerability occurs because the application does not validate or sanitize the `fileName` parameter before using it to access the file system. As a result, an attacker can read or execute files located on the server through relative path manipulation in the input fields.

2. Steps

• Validate user input: Implement input validation to ensure that the fileName parameter is a valid and safe file name.

• Restrict access to specific directories: Limit the access to only specific directories that contain the files that should be accessible.

• Use absolute file paths: Instead of using relative paths, use absolute file paths to ensure that the file being accessed is located in the intended directory.

• Implement access controls: Implement access controls to restrict the files that can be accessed based on user roles or permissions.

• Sanitize user input: Sanitize the fileName parameter to remove any potentially malicious characters or sequences.

• Implement file whitelisting: Maintain a whitelist of allowed file names and only allow access to files that are on the whitelist.

• Implement file blacklisting: Maintain a blacklist of disallowed file names and prevent access to files that are on the blacklist.

• Use file permissions: Set appropriate file permissions to restrict access to sensitive files.

• Implement logging and monitoring: Implement logging and monitoring to detect any attempts to exploit the vulnerability and take appropriate action.

• Regularly update and patch dependencies: Keep all dependencies, including ASP.NET Core, up to date with the latest security patches to prevent known vulnerabilities.

3. Secure code example

using System.IO;
using Microsoft.AspNetCore.Mvc;
using System;
using System.Linq;

public class FileController : Controller
{
    private readonly string BaseDirectory = Path.Combine(Environment.CurrentDirectory, "SafeDirectory"); // Restricted directory...

The updated code includes several security measures to prevent Local File Inclusion (LFI) attacks: 1. **Input Validation**: The `fileName` parameter is checked to ensure it is not null or empty and does not contain any invalid file name characters. If the validation fails, a bad request response is returned. 2. **File Whitelisting**: A list of allowed file names is maintained. If the `fileName` is not in this list, an unauthorized response is returned. 3. **Restricted Directory**: Files can only be accessed from a specific directory (`SafeDirectory`). The absolute path of the file is constructed by combining the base directory path with the `fileName`. 4. **Path Verification**: Before reading the file, the code checks if the file exists and if its path starts with the base directory path. If these conditions are not met, a not found response is returned. These measures ensure that only specific files from a specific directory can be accessed, preventing attackers from reading or executing arbitrary files on the server.

On this page