Remote Command Execution (RCE) is a critical security vulnerability that allows an adversary to execute arbitrary commands on a target system remotely. This typically occurs due to improper input validation, insecure deserialisation, or misconfigured applications. Exploiting RCE can lead to full system compromise, data breaches, or further exploitation within a network.

Remediation

• Ensure all user inputs are properly validated and sanitised to prevent command injection.
• Restrict application and system permissions to minimise the impact of potential exploitation.

Metadata

• Severity: critical
• Slug: remote-command-execution

CWEs

• 88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

OWASP

• A03:2021: Injection