RCE Attack Surface in Modern Web Applications

This note maps RCE surfaces in ordinary web applications so later CVE work has a place to land. It is a surface catalog and a tracing method — not a list of exploits.

If a finding cannot be placed on this map, it is probably not web RCE, and the journal should not call it that.

Web RCE is execution of attacker-influenced code or OS commands in the application process or an adjacent worker. The vulnerability is the missing boundary between request data and a sink that executes.

Application servers, CMS platforms, admin panels, CI callbacks, file processors, and any web app that embeds a template engine, expression language, or native document converter.

High-yield surfaces: file upload and conversion, template preview, report generation, webhook processors, deserialization of session or cache blobs, debug consoles left on, and plugin install endpoints.

Low-yield surfaces that are often mislabelled RCE: reflected XSS in a browser, stored HTML that never leaves the origin, and error messages that only print a stack.

The application treated a request field as an instruction. Root cause is that confusion — in a template name, a converter argument, a shell wrapper, or a serialized session.

Map every interesting parameter to a sink class. If you cannot name the sink, you do not yet have RCE research.

It becomes RCE when the sink executes in a privileged process and the input still influences code or command structure after any sanitizing step. HTML encoding that protects a browser does not protect a shell wrapper or a pickle load.

Web RCE patches often add allowlists on file types, disable expression languages, or remove debug routes. Read whether the sink is gone or merely hidden. Hidden sinks that remain callable from another route are incomplete.

Inventory sinks first, routes second. Code search for process spawn, template compile-from-string, native converters, and object decoders. Then ask which routes can still reach them.

Remove unused sinks. Run converters in isolated workers with no secrets. Disable expression languages in templates. Treat plugin install as code deploy. Keep debug consoles off the production network.

A modern web app has a small number of true execution sinks. Research time should go to those sinks and their callers — not to another generic “injection” paragraph.

OWASP, injection and unsafe deserialization community pages — defensive class definitions.

CWE-94, CWE-78, CWE-502 — for naming, after the sink is identified.

Art of Vector Security disclosure policy — /about/responsible-disclosure.