日本語

CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program
2006-07-19
00h00 +00:00
高
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Improper Control of Filename for Include/Require Statement in PHP Program

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

一般情報

導入モード

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

適用可能なプラットフォーム

言語

名前： PHP (Often)

テクノロジー

クラス： Web Based (Undetermined)
名前： Web Server (Undetermined)

一般的な結果

スコープ 影響 可能性
Integrity
Confidentiality
Availability		Execute Unauthorized Code or Commands

注記： In certain versions and configurations of PHP with the allow_url_include setting enabled, an attacker could specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP. In some cases, the attacker might be able to insert PHP specifiers into a data file, then cause that data file to be included, causing it to be parsed by PHP.

観察された例

参考文献 説明

CVE-2004-0285

Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.

CVE-2004-0030

Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.

CVE-2004-0068

Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.

CVE-2005-2157

Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.

CVE-2005-2162

Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.

CVE-2005-2198

Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.

CVE-2004-0128

Modification of assumed-immutable variable in configuration script leads to file inclusion.

CVE-2005-1864

PHP file inclusion.

CVE-2005-1869

PHP file inclusion.

CVE-2005-1870

PHP file inclusion.

CVE-2005-2154

PHP local file inclusion.

CVE-2002-1704

PHP remote file include.

CVE-2002-1707

PHP remote file include.

CVE-2005-1964

PHP remote file include.

CVE-2005-1681

PHP remote file include.

CVE-2005-2086

PHP remote file include.

CVE-2004-0127

Directory traversal vulnerability in PHP include statement.

CVE-2005-1971

Directory traversal vulnerability in PHP include statement.

CVE-2005-3335

PHP file inclusion issue, both remote and local; local include uses ".." and "%00" characters as a manipulation, but many remote file inclusion issues probably have this vector.

CVE-2009-1936

Chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.

潜在的な緩和策

Phases : Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Phases : Architecture and Design
Phases : Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Phases : Architecture and Design // Operation
Phases : Architecture and Design // Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Phases : Implementation
Phases : Architecture and Design // Operation
Phases : Architecture and Design // Implementation
Phases : Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Phases : Operation // Implementation
Ensure that the allow_url_include setting is off. Refactor the code if necessary.
Phases : Operation // Implementation
Develop and run the code in the most recent versions of PHP available. Many of the highly risky features in earlier PHP interpreters have been removed, restricted, or disabled by default.
Phases : Operation // Implementation
Phases : Operation
Set allow_url_fopen to false, which limits the ability to include files from remote locations.

検出方法

Manual Analysis

Manual white-box analysis can be very effective for finding this issue, since there is typically a relatively small number of include or require statements in each program.
有効性 : High

Automated Static Analysis

脆弱性マッピングノート

理由 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

関連する攻撃パターン

CAPEC ID 攻撃パターン名
CAPEC-193 PHP Remote File Inclusion
In this pattern the adversary is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized "include" or "require" call, which the user can then control to point to any web-accessible file. This allows adversaries to hijack the targeted application and force it to execute their own instructions.

ノート


参考文献

REF-185

Testing for Path Traversal (OWASP-AZ-001)
OWASP.
http://www.owasp.org/index.php/Testing_for_Path_Traversal_(OWASP-AZ-001)

REF-76

Least Privilege
Sean Barnum, Michael Gegick.
https://web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/least-privilege

REF-951

A Study in Scarlet
Shaun Clowes.
https://www.cgisecurity.com/lib/studyinscarlet.txt

REF-952

Suhosin
Stefan Esser.
http://www.hardened-php.net/suhosin/

REF-953

Top 25 Series - Rank 13 - PHP File Inclusion
Johannes Ullrich.
https://www.sans.org/blog/top-25-series-rank-13-php-file-inclusion/

REF-1481

D3FEND: Application Layer Firewall
D3FEND.
https://d3fend.mitre.org/dao/artifact/d3f:ApplicationLayerFirewall/

REF-1482

D3FEND: D3-TL Trusted Library
D3FEND.
https://d3fend.mitre.org/technique/d3f:TrustedLibrary/

登録情報

名前 組織 日付 リリース日 Version
PLOVER 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

変更履歴

名前 組織 日付 コメント
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Relationships, Relationship_Notes, Research_Gaps, Taxonomy_Mappings
CWE Content Team MITRE 2009-01-12 +00:00 updated Relationships
CWE Content Team MITRE 2009-03-10 +00:00 updated Relationships
CWE Content Team MITRE 2009-05-27 +00:00 updated Description, Name
CWE Content Team MITRE 2009-12-28 +00:00 updated Alternate_Terms, Applicable_Platforms, Demonstrative_Examples, Likelihood_of_Exploit, Potential_Mitigations, Time_of_Introduction
CWE Content Team MITRE 2010-02-16 +00:00 converted from Compound_Element to Weakness
CWE Content Team MITRE 2010-02-16 +00:00 updated Alternate_Terms, Common_Consequences, Detection_Factors, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Type
CWE Content Team MITRE 2010-06-21 +00:00 updated Potential_Mitigations, References
CWE Content Team MITRE 2010-09-27 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2010-12-13 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2011-06-27 +00:00 updated Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations, References
CWE Content Team MITRE 2013-02-21 +00:00 updated Alternate_Terms, Name, Observed_Examples
CWE Content Team MITRE 2017-01-19 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Affected_Resources, Demonstrative_Examples, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships
CWE Content Team MITRE 2019-06-20 +00:00 updated Type
CWE Content Team MITRE 2020-02-24 +00:00 updated Potential_Mitigations, Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2021-03-15 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2021-10-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-04-28 +00:00 updated Research_Gaps
CWE Content Team MITRE 2022-10-13 +00:00 updated References
CWE Content Team MITRE 2023-01-31 +00:00 updated Description, Detection_Factors
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships, Time_of_Introduction
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-04-03 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2025-09-09 +00:00 updated Potential_Mitigations, References
CWE Content Team MITRE 2025-12-11 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Relationships, Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Alternate_Terms, Common_Consequences, Description, Dimensions, Name, Potential_Mitigations
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。