php-file-read-audit

PHP Arbitrary File Read Audit (php-file-read-audit)

Analyze PHP project source code to identify file read and include execution risks: path traversal leading to arbitrary file read, inclusion of arbitrary files (include/require) leading to information disclosure or code execution (when the included content is executable/or affected by stream wrappers).

Grading and Numbering

• See:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-FILE-{序号}

FILE Sink (mandatory)

Identify the following functions/syntax:

• Read:file_get_contents/readfile/fopen/stream_get_contents/file/Storage::get
• Include:include/require/include_once/require_once(path concatenation risk is especially high)
• Compress/Archive:ZipArchive->open(if the path is controllable)
• Stream wrapper/filter:php://filter、php://input(if read/included as file content) Danger: when allow_url_fopen/allow_url_include or the wrapper allows it, read/include can cross protocols Dangerous patterns:
• The read/include path variable comes directly from user input
• Path concatenation without normalization and basePath validation
• Allows file://、php://、data://、zip:// and other stream wrappers without restriction
• In include/require scenarios there exists allow_url_include=On or evidence that network/cross-protocol include is indirectly enabled via configuration/wrapping

Path Traversal Detection (mandatory)

Must analyze and provide evidence:

• Whether it filters ../、..\\, mixed separators
• Whether it performs realpath/canonicalize and validates the prefix using basePath
• Whether it handles stream wrapper prefixes:php://、file://、phar://、zip:// etc. (must be evidenced item by item)
• Encoding/double encoding/case/trailing spaces/\0(old PHP versions) bypass possibilities
• Whether a whitelist is applied to suffixes/extensions, and whether the whitelist is not easy to bypass

Include Execution Determination (mandatory: improve true positives)

When detected include/require* uses a controllable path, the following determination evidence must be output (cannot be skipped):

1. Included content type: Whether the inclusion target may be executed as PHP code (e.g., extension/parsing method/execution path evidence)
2. Final resolution result of the include path: Whether it still points to a controllable resource after wrapper resolution
3. Execution surface boundary: Whether the include/require is located after exception handling or return/throw branches (even if it can be read, it may not execute)
4. Configuration evidence: Whether there exists allow_url_include=On, or auto_prepend_file/auto_append_file, or a custom wrapper's allow point for include

Tracer trigger conditions (mandatory)

• The path passes through multiple layers of functions/JSON fields
• A branch exists: whether the validation logic only takes effect in one path branch

Report Output

Output to:

{output_path}/vuln_audit/file_{timestamp}.md

Vulnerability Entry Template (mandatory)

Must include:

• Location evidence
• Data flow chain (Source→Sink, including path concatenation and validation branches)
• Evidence references (from php-route-tracer output, must be cited item by item): must correspond to and cite the evidence points in the trace's ## 9) Sink Evidence Type Checklist(FILE lines)
  • EVID_FILE_WRAPPER_PREFIX: wrapper/stream wrapper prefix (e.g., php:///phar:///zip:// , etc.)
  • EVID_FILE_RESOLVED_TARGET: final/resolved target (the final target after wrapper resolution)
  • EVID_FILE_INCLUDE_REQUIRE_EXEC_BOUNDARY: include/require execution-surface boundary (whether PHP code will be executed vs merely reading content/erroring; this evidence point may also include evidence related to allow_url_include/wrapper allowance)
• Exploitable preconditions (authentication/input controllability/trigger conditions)
• Executable PoC (HTTP request, including the real route)
• Recommended fix (basePath validation + stream wrapper disabling strategy + key points for secure alternatives to include/require + code search statements)

Handling missing tracer evidence (mandatory)

• If in the trace's ## 9) Sink Evidence Type Checklist(FILE line), any key evidence point is missing or cannot be mapped to this vulnerability: the status of this vulnerability must be ⚠️待验证(must not directly give ✅已确认可利用）。