Remote Code Execution (RCE).

What is remote code execution?

Remote code execution (RCE) is when an attacker runs code of their choice on another person’s system from a distance. It is also called arbitrary code execution. The word “remote” means the attacker does not need to sit at the machine. The word “arbitrary” means the attacker, not the owner, picks the code.

A remote code execution vulnerability is a weakness in software that makes this possible.

How does remote code execution work?

OWASP describes code injection as the general term for attacks that inject code that is then interpreted or executed by the application. It says these attacks exploit poor handling of untrusted data, through weak input validation.

MITRE describes the same weakness in CWE-94. In its words, the product builds all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize, or incorrectly neutralizes, special elements that could modify the syntax or behavior of the intended code segment. MITRE adds that this lets attackers inject control plane data through legitimate data channels, which alters program execution.

What does a simple example look like?

This is a simple illustration, not a real case. A web application takes text from a form and passes it to a function that runs text as code. A normal user types a name. An attacker types text that is itself code, and the application runs it. OWASP shows examples of this kind, where attackers abuse functions such as eval() and include() to run injected code.

What can an attacker do with it?

OWASP says a successful code injection attack can result in loss of confidentiality, loss of integrity, loss of availability, and loss of accountability. In plain terms, data can be exposed or changed, and services can be disrupted.

How can remote code execution be reduced?

MITRE lists several mitigations for code injection. At the design stage, it suggests refactoring code to avoid generating code dynamically, running code in sandboxed environments such as chroot jails or AppArmor, and strict allowlist input validation. It notes that sandboxes contain an attack rather than prevent it. At the implementation stage, it suggests allowlists rather than relying only on blocklists, and fuzz testing and robustness testing. Fuzzing means feeding a program unexpected input to see how it behaves.

OWASP stresses proper data validation, such as checking allowed characters, data format and expected amounts of data.

CISA advises installing updates as soon as possible to protect devices against attackers who take advantage of system vulnerabilities. It also says attackers may target vulnerabilities for months or even years after updates are available.

Is remote code execution the same as code injection?

Not exactly. Code injection is a type of attack and a type of weakness. Remote code execution describes the result, where an attacker runs code on a system from afar.

Which terms are related?

Related terms include patch management, vulnerability management and zero-day vulnerability.