Local file inclusion vulnerability triggered
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect successful exploits of the local file inclusion vulnerability.
Strategy
Run a heuristic in the library (rule rasp-930-100) to monitor file access.
When a file is accessed from a path controlled by the user (and that the path doesn’t appear legitimate), those specific accesses are highlighted.
Since the exploit is proven and the attacker may be leaking sensitive data, the severity of the signal is set to CRITICAL.
Triage and response
- Consider blocking the attacking IPs temporarily to slow down the further exploitation of your infrastructure.
- Consider switching the WAF rule
rasp-930-100 to blocking mode to prevent exploitation. - Leverage traces to determine the vulnerable codepath, and fix the code.
