ColdFusion Bad Practices: Unauthorized Include

Allowing unvalidated user input to specify the path of a file included in the page can allow attackers to inject malicious code or view sensitive files on the server.

Unauthorized include vulnerabilities occur when:

1. Data enters a web application through an untrusted source, most frequently a web request.

2. The data is part of the string specifying the template attribute of a <cfinclude> tag.
Example: The following code uses input from a web form to construct the path to a special file used to format the user's homepage. The programmer has not considered the possibility that an attacker may provide a malicious filename, such as "../../users/wileyh/malicious", which will cause the application to include and execute the contents of a file in the attacker's home directory.

<cfinclude template =  
              "C:\\custom\\templates\\#Form.username#.cfm">

If an attacker is allowed to specify the file included by the <cfinclude> tag, they may be able to cause the application to include the contents of nearly any file in the server's file system in the current page. This ability can be leveraged in at least two significant ways. If an attacker can write to a location on the server's file system, such as the user's home directory or a common upload directory, then they may be able to cause the application to include a maliciously crafted file in the page, which will be executed by the server. Even without write access to the server's file system, an attacker may often gain access to sensitive or private information by specifying the path of a file on the server.