What is remote code execution?

Remote code execution (or RCE), often also referred to as arbitrary code execution (or ACE), is a classification of vulnerabilities that allow an attacker to run any command or code on a target system or within a target process.

RCE is a top exploitation technique that can be found in software or hardware. RCE vulnerabilities are highly desirable vulnerabilities for adversaries to exploit.

How does remote code execution work?

RCE attacks exploit the possibility of executable code being injected into a file or process and executed or evaluated. This can be due to user input not being validated or other situations not intended by developers. Injected code is usually in the programming language of the targeted application, like PHP, Java, Python, Ruby, etc.

Depending on the vulnerability targeted, attackers will typically use the privileges of the target process to execute the code. For example, if attackers inject code as a user, they will naturally be using that user’s current privilege level.

Because of this, RCE is commonly paired with attempts to escalate privileges and gain control on an administrative or root level. Elevated privilege can also allow attackers to more easily hide the attack.

However, even without more extraordinary privilege, the remote code execution vulnerability has the potential to cause serious harm.

Key examples of remote code execution:

• WannaCry (CVE-2017-0143)

• DogWalk (CVE-2022-34713)

• Log4Shell (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-4104 & CVE-2021-44832)

• BlueKeep (CVE-2019-0708)

• Follina (CVE-2022-30190)

• EvilPrinter (CVE-2020-1300)

• SigRed (CVE-2020-1350)

Impact of remote code execution

The impact of RCE can vary dramatically depending on the application being injected with malicious code, the privileges of the current process or user, or the sensitivity/value of the target system.

Typically, successful exploitation of an RCE vulnerability will lead to the attacker gaining access to an application or the system. This can allow the attacker to access and inject additional code or instructions into the underlying device’s commands or processes.

RCE can also often lead to sensitive data access for exfiltration or utilization in further attacks within the target system and adjacent systems. Attackers could also disrupt or crash the service or host device by executing destructive commands.

The most common outcome of RCE attacks over the past few years however is ransomware or cryptomining. RCE can easily be used to take over the system allowing for a monetizable event for the attacker.

How to mitigate remote code execution

The most effective way to mitigate or eliminate exposure to remote code execution vulnerabilities is through regular security updates. Automox recommends that you take these four steps to effectively mitigate exposure to RCE vulnerabilities:

Automox for Easy IT Operations

Automox is the cloud-native IT operations platform for modern organizations. It makes it easy to keep every endpoint automatically configured, patched, and secured – anywhere in the world. With the push of a button, IT admins can fix critical vulnerabilities faster, slash cost and complexity, and win back hours in their day.