Remote Code Execution

Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.

Term

description · examples · notes

Description

It is reached through configuration mistakes, vulnerable libraries, insecure deserialization, file upload, document parsers, memory handling or wrongly exposed services. The details differ, but the consequence is the same: the application receives something it should not and executes something the attacker controls.

RCE rarely stays an isolated technical event. After the first execution come a web shell, further tools, data theft, lateral movement and an attempt to keep the unauthorized access alive. RCE is therefore not treated as a bug to be fixed but as the possible beginning of a system compromise.

Examples

A vulnerable image-processing library on the server lets an attacker run remote commands through a specially prepared file.
An upload form accepts a file that is later executed as a script on the server.
A deserialization flaw lets an attacker run system commands through a specially assembled request.

Notes

With an RCE vulnerability the question is not only whether the patch is installed, but what happened before it was.
A server that was vulnerable and publicly reachable should also be examined as potentially compromised.

Mentioned in the news

Techniques

carried out with 5

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 9

How it is defended against. Select one to open its page.