File access functions in PHP are typically used to open local files. They are also capable of reading files from remote servers using protocols such as HTTP, HTTPS and FTP.
This behavior is controlled by the allow_url_fopen and allow_url_include settings.
Most applications do not require or expect the file access functions to download remotely accessible files. However, attackers can abuse these remote file access features while exploiting other vulnerabilities, such as path traversal issues.
While activating these settings does not pose a direct threat to the application’s security, they can make the exploitation of other vulnerabilities easier and more severe.
If an attacker can control a file location while allow_url_fopen is set to 1, they can use this ability to perform a
Server-Side Request Forgery exploit. This allows the attacker to affect more than just the local application and they may be able to laterally attack
other assets on the local network.
If allow_url_include is set to 1, the attacker will also have the ability to download and execute arbitrary PHP code.
allow_url_fopen and allow_url_include should be deactivated in the main PHP configuration file. Note that
allow_url_include is disabled by default while allow_url_fopen is not and must be explicitly disabled.
; php.ini Noncompliant; allow_url_fopen is enabled by default allow_url_include=1 ; Noncompliant
; php.ini allow_url_fopen=0 allow_url_include=0