sc-rce

SC: Remote Code Execution (RCE)

Purpose

Detects remote code execution vulnerabilities where user-controlled input reaches functions that evaluate or execute code dynamically. Covers eval-based injection, dynamic function construction, script engine execution, template code execution, and code loading from untrusted sources. This skill focuses on code evaluation mechanisms beyond command injection (covered by sc-cmdi) and deserialization (covered by sc-deserialization).

Activation

Called by sc-orchestrator during Phase 2. Runs against all detected languages.

Phase 1: Discovery

Keyword Patterns to Search

# Python
"eval(", "exec(", "compile(", "__import__(", "importlib.import_module(",
"builtins.__import__", "code.InteractiveInterpreter", "ast.literal_eval"

# JavaScript/Node.js
"eval(", "Function(", "setTimeout(.*string", "setInterval(.*string",
"vm.runInNewContext(", "vm.runInThisContext(", "vm.createContext(",
"require(.*variable", "import(.*variable", "new Function("

# PHP
"eval(", "assert(", "create_function(", "preg_replace(.*/e",
"call_user_func(", "call_user_func_array(", "array_map(",
"usort(.*\\$", "include(.*\\$", "require(.*\\$"

# Java
"ScriptEngine", "ScriptEngineManager", "Nashorn", "GraalVM",
"GroovyShell", "GroovyClassLoader", "javax.script",
"MethodHandle", "ClassLoader.loadClass"

# C#
"CSharpCodeProvider", "Roslyn", "Microsoft.CodeAnalysis",
"Assembly.Load(", "Activator.CreateInstance(",
"Type.GetType(.*variable", "DynamicMethod"

# Go
"plugin.Open(", "yaegi", "go/ast"

# Ruby
"eval(", "instance_eval(", "class_eval(", "module_eval(",
"send(.*variable", "public_send(", "method("

Data Flow Tracing

Trace user input to any dynamic code evaluation function. Key patterns:

• HTTP parameter → variable → eval()
• Database value (originally user input) → code execution function
• Configuration file (user-editable) → dynamic import/require
• WebSocket message → eval-like function

Phase 2: Verification

Python Examples

# VULNERABLE: eval with user input
result = eval(request.GET['expression'])

# VULNERABLE: exec with user input
exec(request.POST['code'])

# SAFE: ast.literal_eval for safe subset
import ast
result = ast.literal_eval(request.GET['data'])  # Only parses literals

# SAFE: Restricted evaluation with custom namespace
allowed_names = {"abs": abs, "min": min, "max": max}
result = eval(expression, {"__builtins__": {}}, allowed_names)
# Note: Still risky — sandbox escapes are possible