Command Shell in Externally Accessible Directory
Weakness ID: 553 (Weakness Variant)Status: Incomplete
+ Description

Description Summary

A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.
+ Time of Introduction
  • Implementation
  • Operation
+ Potential Mitigations

Verify the deployment of the application. Check that no directory listing is exposing the file system.

Perform input data validation before doing path resolution.

Remove any Shells accessible under the web root folder and children directories.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness BaseWeakness Base552Files or Directories Accessible to External Parties
Development Concepts (primary)699
Research Concepts (primary)1000
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
Anonymous Tool Vendor (under NDA)Externally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Potential Mitigations, Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Taxonomy Mappings
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Possible Command Shell (csh)
Back to top