RCE
CriticalRemote Code Execution
Definition
Remote Code Execution (RCE) is the ability to run arbitrary code on a remote system without physical or prior access to it. It is not a vulnerability in itself, but an impact that can result from multiple types of vulnerabilities such as command injection, SSTI, deserialization, SQLi or SSRF. It is the holy grail of bug bounty for its maximum impact.
Impact
Full compromise of the affected serverAccess to all data stored on the systemPossibility of lateral movement to other internal systemsInstallation of backdoors for persistent accessMaximum reward in bug bounty programs (10k-100k+ EUR)
Examples
Common chains to achieve RCE
The most common chains to achieve RCE in bug bounty include: SSRF → Cloud metadata → Credentials → Access to internal services, SSTI → Template-engine code execution, Deserialization → Gadget chain → System.exec(), LFI → Log poisoning → PHP code inclusion, SQL Injection → xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL).