4 ms·

Remote code execution already implies unauthorized. There is no such thing as authorized remote code execution.

deleted 3y ago
[deleted]
kevindamm 3y ago
What makes you say that? SSH, RDP, even hitting a web service are all valid cases of authorized remote code execution. It's not the remote or execution parts that are bad.
- dist-epoch 3y ago
  Now you're redefining words. Remote code execution means a single thing, running JavaScript when accessing a web page and using SSH as intended is not RCE. https://en.wikipedia.org/wiki/Remote_code_execution https://en.wikipedia.org/wiki/Remote_code_execution https://www.google.com/search?q=Remote+code+execution https://www.google.com/search?q=Remote+code+execution
  - kevindamm 3y ago
    I may not have been clear -- I agree that RCE, unqualified, means unauthorized RCE. but then you said there was no such thing as an "authorized" RCE and that's where I beg to differ. Sure, the term isn't used much but it wasn't the clarifying point I wanted to make above, that there is a difference between authenticated and authorized. The links you point to there are about "RCE attack" which also implies not authorized.
    - dist-epoch 3y ago
      Your original post: > in the introductory paragraph it reads "unauthenticated, targeted remote code execution ... I believe this means it was unauthorized, not unauthenticated. You again: > agree that RCE, unqualified, means unauthorized RCE So you agree that your "unauthorized" qualification from your orignal post was unwarranted, since all unqualified RCE are unauthorized. Now if you want to split hairs, you'll say "but the introductory paragraph said unauthenticated, which is qualified RCE, thus I am still right". ok then
gquere 3y ago
There totally is authenticated RCE, for instance a PHP page that contains a RCE but needs a prior authentication to access the resource. All RCEs are classified in either unauthenticated or authenticated, the former being the worst (or best if you're a researcher/hacker).

deleted 3y ago

[deleted]

What makes you say that? SSH, RDP, even hitting a web service are all valid cases of authorized remote code execution. It's not the remote or execution parts that are bad.

dist-epoch 3y ago
Now you're redefining words. Remote code execution means a single thing, running JavaScript when accessing a web page and using SSH as intended is not RCE. https://en.wikipedia.org/wiki/Remote_code_execution https://en.wikipedia.org/wiki/Remote_code_execution https://www.google.com/search?q=Remote+code+execution https://www.google.com/search?q=Remote+code+execution
- kevindamm 3y ago
  I may not have been clear -- I agree that RCE, unqualified, means unauthorized RCE. but then you said there was no such thing as an "authorized" RCE and that's where I beg to differ. Sure, the term isn't used much but it wasn't the clarifying point I wanted to make above, that there is a difference between authenticated and authorized. The links you point to there are about "RCE attack" which also implies not authorized.
  - dist-epoch 3y ago
    Your original post: > in the introductory paragraph it reads "unauthenticated, targeted remote code execution ... I believe this means it was unauthorized, not unauthenticated. You again: > agree that RCE, unqualified, means unauthorized RCE So you agree that your "unauthorized" qualification from your orignal post was unwarranted, since all unqualified RCE are unauthorized. Now if you want to split hairs, you'll say "but the introductory paragraph said unauthenticated, which is qualified RCE, thus I am still right". ok then

gquere 3y ago

There totally is authenticated RCE, for instance a PHP page that contains a RCE but needs a prior authentication to access the resource. All RCEs are classified in either unauthenticated or authenticated, the former being the worst (or best if you're a researcher/hacker).