3 ms·

Here's a question I have every time I see "RCE" type issues, and I'm completely serious when I ask: what is the use case for allowing remote execution in your s

Here's a question I have every time I see "RCE" type issues, and I'm completely serious when I ask: what is the use case for allowing remote execution in your software? Why would you want to allow arbitrary code to be executed? Or am I perhaps misunderstanding this, is it some sort of break out of the program bounds which allows execution?

yuhong 10y ago
The latter.
Buge 10y ago
It's a vulnerability. No one wants it (except attackers). Of course there are some situations that some people actually do want (controlled) remote code execution, such as ssh.
Forge36 10y ago
I've seen a few cases. (Not that they were justified, but that it was a very convenient way to program by someone at the time) The use case here being you fully trust another developer to use the API properly, not realizing a user could also use the API. Now, code review with a security perspective is usually enough to stop intentionally adding it.