WTF are RCE and privilege escalation?
Short version
RCE lets an attacker run their code on your system. Privilege escalation gets them more power once inside.
The briefing
- RCE
- Remote code execution. An attacker can make a system run their code from somewhere else, often over a network. CVSS calls that kind of reach "remotely exploitable".
- Classic cause
- Injection, where software treats outside input as code or commands.
- Privilege escalation
- MITRE ATT&CK describes it as techniques adversaries use to gain higher-level permissions. They often get in with unprivileged access, then climb to local administrator or SYSTEM/root.
- "Root"
- The top account on Linux and macOS. SYSTEM is the Windows equivalent. Whoever holds it runs the machine.
- "Full takeover"
- Headline language, not a formal rating. Read the advisory to see what the attacker really gets.
- "Chained flaws"
- One bug sets up the next. The first gets a foothold and the second gets root. The MITRE CWE catalog labels real examples of these chains.
- One number will not do
- Each flaw normally gets its own CVE and its own score, so one number will not show you the whole attack.
In the Threat Brief this looks like:
Chained flaws in ExampleApp give an attacker root. Full takeover.
One bug set up the next. "Full takeover" is headline language, so read the advisory for what the attacker really gets.
Example only. The product, versions and names are made up.
What to do
- Put an RCE on anything facing the internet at the top of the pile. If it needs no login, go faster.
- Do not wave off a "local" or low-privilege bug. It may be the second link in someone's chain.
- Run things with the least privilege they need. That limits what an attacker inherits when something breaks.