Remote Code Execution Vulnerability: What is it and how to stay protected from it?

• Remote Code Execution (RCE) Vulnerability could allow an attacker to gain full control of a victim’s infected machine.
• An attacker gaining access to a victim’s machine exploiting the RCE vulnerability can execute system commands, write, modify, delete or read files, and can connect to databases.

Remote code execution vulnerability allows an attacker to gain access to a victim's machine and make changes, irrespective of where the machine is geographically located. This vulnerability can lead to a full compromise of the infected machine.

RCE vulnerabilities can provide an attacker with the ability to execute malicious code and take complete control of an infected system with the privileges of the victim running the application.

After gaining access to the system, attackers will often attempt to elevate their privileges. Once the attacker remotely executes malicious code on a vulnerable system and gains access to the infected system, he can execute system commands, write, modify, delete or read files, and can connect to databases.

Example of RCE Vulnerability

One example of a Remote Code Execution vulnerability is the CVE-2018-8248 vulnerability. This vulnerability is also known as ‘Microsoft Excel Remote Code Execution Vulnerability’. This vulnerability could allow an attacker to run malware on a vulnerable computer.

An attacker exploiting this vulnerability could take full control of the victim’s machine when the victim logs on to the machine with administrative user privileges. Once the system is compromised, the attacker could view, modify or delete data, install programs, as well as create new accounts with full user privileges.

According to Microsoft, there can be two delivery methods to exploit this CVE-2018-8248 vulnerability,

• One delivery method could be in the form of a phishing email with a Microsoft Excel attachment that contains a specially crafted malicious file.
• Another method is via web-based attack, where an attacker could host a compromised website that accepts or hosts user-provided content containing a malicious file designed to exploit the CVE-2018-8248 vulnerability.

In both the scenarios, malicious email and web-based attack, the attacker has to persuade users to click on the attachment or a link to open the malicious file. This vulnerability has been fixed by Microsoft.

How to protect your computer from RCE Vulnerability?

• The best way to protect a computer from a remote code execution vulnerability is to fix loopholes that could allow an attacker to gain access.
• To protect a computer from such vulnerability, users must periodically update their software and must keep their system up-to-date.
• If your organization is using servers that have software which is vulnerable to remote code execution, then the latest software security patch should be applied.
• Moreover, it is best to automate server patching in order to prevent remote code execution attacks.
• It is recommended not to open any file or attachment from an anonymous sender.
• Another best option would be to not use functions such as eval and to not allow anyone to edit the content of files that might be parsed by the respective languages.
• In order to protect a computer from RCE, you should not allow a user to decide the name and extensions of files.
• To prevent RCE, you should not sanitize user input and should not pass any user-controlled input inside evaluation functions or callbacks.
• It is also recommended to not blacklist special characters or function names.