CWE-553, Command Shell in Externally Accessible Directory, describes a possible shell file sitting in /cgi-bin/ or another accessible directory. MITRE calls this extremely dangerous because an attacker can use it to execute commands on the web server.
How it happens
Two ways. A developer or administrator leaves a utility shell on the server for convenience and forgets it. Or an attacker who already got a foothold, say through a file upload flaw, plants a shell in a web folder so they can return later.
Either way the result is the same: a URL that runs commands.
What an attacker gains
MITRE lists confidentiality, integrity and availability impacts, all through executing unauthorized code or commands. This is full control of the web server process: read data, change it, or take the service down.
How to find it
- List files under the web root and its subfolders, with attention to
cgi-bin. - Compare the file list with your known release contents. Any file you did not deploy is suspect.
- Watch for recently modified files in web directories.
- Search for scripts that call a system shell with request data.
find /var/www -type f -newer /var/www/.last-deploy -ls
How to fix it
MITRE's mitigation, at installation and configuration time: remove any shells accessible under the web root folder and its child directories.
- Delete unknown executables and shell scripts under served directories.
- If one appeared that you did not put there, treat the server as compromised and find how it got in.
- Deploy from a clean build so extra files cannot linger.
- Mount the web root read-only where practical, and keep upload folders from executing code.
Quick check
You found and removed a shell. Is the job done?
Not yet. If you did not place it, someone else did, so you need to find the entry point and review what they did with it.
