RFI Security

Remote File Inclusion (RFI) is an attack that targets the computer servers that run Web sites and their applications.
It allows the attacker to upload a custom coded/malicious file on a website or server using a script. The vulnerability exploit the poor validation checks in websites and can eventually lead to code execution on server or code execution on website.Using RFI we can l deface the websites, get access to the server and do almost anything.

Vulnerable Code:- 

<?php
 // remove a file from the user's home directory 
$username = $_POST['user_submitted_name'];
 $userfile = $_POST['user_submitted_filename']; 
$homedir = "/home/$username"; 
unlink("$homedir/$userfile"); 
echo "The file has been deleted!"; 
?>

Attacking Code:- 

<?php 
// removes a file from anywhere on the hard drive that
 // the PHP user has access to. If PHP has root access: 
$username = $_POST['user_submitted_name']; // "../etc"
 $userfile = $_POST['user_submitted_filename']; // "passwd" 
$homedir = "/home/$username"; // "/home/../etc"
 unlink("$homedir/$userfile"); // "/home/../etc/passwd" 
echo "The file has been deleted!"; 
?>

Security:-

1. Only allow limited permissions to the PHP web user binary.

 <?php 
// removes a file from the hard drive that 
// the PHP user has access to.
 $username = $_SERVER['REMOTE_USER']; 
// using an authentication mechanisim
 $userfile = basename($_POST['user_submitted_filename']); 
$homedir = "/home/$username"; 
$filepath = "$homedir/$userfile";
if (file_exists($filepath) && unlink($filepath)) {
 $logstring = "Deleted $filepath\n";
 } else { 
$logstring = "Failed to delete $filepath\n"; 
} 
$fp = fopen("/home/logging/filedelete.log", "a");
 fwrite($fp, $logstring); fclose($fp); 
echo htmlentities($logstring, ENT_QUOTES);
 ?>
2. Check all variables which are submitted.
 <?php
 $username = $_SERVER['REMOTE_USER'];
 // using an authentication mechanisim 
$userfile = $_POST['user_submitted_filename']; 
$homedir = "/home/$username"; 
$filepath = "$homedir/$userfile"; 
if (!ctype_alnum($username) || !preg_match('/^(?:[a-z0-9_-]|\.(?!\.))+$/iD', $userfile)) {
 die("Bad username/filename"); 
} 
//etc... 
?>