Remote Code Execution
Remote Code Execution (RCE) is attackers executing arbitrary code on the target server; the most severe class of security vulnerability.
Purpose
To understand the many paths to RCE (deserialization, command injection, SSTI) and their defenses; the highest priority in security assessment.
Mechanism
Through command injection, deserialization, SSTI, file upload, and other paths, attacker code runs on the server to obtain a shell or implant a backdoor. Defenses: input validation, least privilege, sandboxing, WAF.
Use cases
- Vulnerability severity assessment
- Penetration testing
- Server security