Remote code execution (RCE)
RCE · remote code execution · arbitrary code execution · ACE · command injection · exécution de code à distance
A vulnerability that lets an attacker run their own commands on a remote machine, usually over the network, which often amounts to taking control of it.
In practice
RCE is the worst outcome a flaw can have, whether it comes from operating-system command injection, unsafe deserialisation, a buffer overflow or code loaded from a source the attacker controls. When it requires no login and no user action and affects an internet-facing service, it earns a critical CVSS score and is quickly exploited at scale. It is the favourite way in for ransomware gangs and espionage groups.
In December 2021, Log4Shell (CVE-2021-44228), a flaw in the Apache Log4j logging library, let an unauthenticated attacker take control of a system with a single crafted request. Because Log4j is built into countless applications, CISA ordered US federal agencies to patch as an emergency.
How to protect yourself
- Patch RCE flaws listed in the KEV catalogue first, especially on exposed systems.
- Keep an SBOM so you can find a vulnerable library in minutes.
- Never pass user data to a command shell, to dynamic code evaluation or to unsafe deserialisation.
- Restrict server privileges and outbound connections to limit the impact.
