CWE-553 外部可访问目录中的命令行Shell

Command Shell in Externally Accessible Directory

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 552 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 552 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围	影响	注释
['Confidentiality', 'Integrity', 'Availability']	Execute Unauthorized Code or Commands

可能的缓解方案

['Installation', 'System Configuration']

策略:

Remove any Shells accessible under the web root folder and children directories.

相关攻击模式

• CAPEC-650

文章来源于互联网:scap中文网