Remote Code Execution (RCE)
An attacker runs arbitrary code on the server - the most severe class, often via injection, deserialization, or vulnerable dependencies.
Overview
RCE arises when untrusted input reaches a code/command interpreter, an unsafe deserializer, a template engine (SSTI), or a known-vulnerable library. The result is attacker-controlled execution in the application’s context.
How it works
RCE arises when untrusted input reaches a code/command interpreter, an unsafe deserializer, a template engine (SSTI), or a known-vulnerable library. The result is attacker-controlled execution in the application’s context.
Example
Impact
Full server compromise, data theft, lateral movement, and persistence.
Detection
Combine version fingerprinting against known CVE templates, SSTI math probes, and safe deserialization markers. A confirmed-version CVE match is the highest-confidence signal and should be treated as critical over a heuristic probe alone.
Prevention
- Never pass input to eval/exec, system shells, or template sources.
- Avoid native deserialization of untrusted data; use safe formats with schemas.
- Patch dependencies continuously and track SBOM/CVEs.
- Run services least-privileged and sandboxed.