T1505.003 Web Shell
Unter-TechnikEnterpriseAdversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).
Plattformen
Plattformen, für die dies gilt.
Taktiken
ATT&CK-Taktiken, denen diese Technik dient.
Unter-Technik von
Die übergeordnete Entität.
Gegenmaßnahmen
ATT&CK-Gegenmaßnahmen, die dies verringern.
Erkannt durch (5)
Datenkomponenten, die dies erkennen.
Abgewehrt durch (D3FEND)
D3FEND-Gegenmaßnahmen dagegen.
Model
Detect
Isolate
Deceive
Evict
NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)
NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).
- PR.AAIdentity Management, Authentication, and Access Controlstark · gestützt durch 4 von 8 zugeordneten Controls
- DE.CMContinuous Monitoringmoderat · gestützt durch 3 von 8 zugeordneten Controls
- PR.DSData Securitymoderat · gestützt durch 3 von 8 zugeordneten Controls
Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.
Mindernde Maßnahmen (8)
Sicherheitskontrollen, die dies mindern.
bekannt ausgenutzte CVEs (26)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-4427US | high7.5OT kritisch | KEV | ||
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the… | ||||
| CVE-2025-42999US | —OT kritisch | KEV | ||
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a… | ||||
| CVE-2025-35939US | medium5.3OT kritisch | KEV | ||
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Cra… | ||||
| CVE-2025-3928US | high8.8OT kritisch | KEV | ||
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised… | ||||
| CVE-2025-31324US | critical9.8OT kritisch | KEV | ||
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries tha… | ||||
| CVE-2024-21893US | high8.2OT kritisch | KEV | ||
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an att… | ||||
| CVE-2024-21887US | critical9.1OT kritisch | KEV | ||
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send special… | ||||
| CVE-2023-46805US | high8.2OT kritisch | KEV | ||
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing co… | ||||
| CVE-2023-32315US | high7.5OT kritisch | KEV | ||
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal… | ||||
| CVE-2023-20118US | high7.2OT kritisch | KEV | ||
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote att… | ||||
| CVE-2023-26360US | —OT kritisch | KEV | ||
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code… | ||||
| CVE-2023-22952US | high8.8OT kritisch | KEV | ||
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. | ||||
| CVE-2022-41082US | —OT kritisch | KEV | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2022-22954US | critical9.8OT kritisch | KEV | ||
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trig… | ||||
| CVE-2022-22963US | critical9.8OT kritisch | KEV | ||
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r… | ||||
| CVE-2021-44228US | critical10.0OT kritisch | KEV | ||
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai… | ||||
| CVE-2021-27860US | high8.8OT kritisch | KEV | ||
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker… | ||||
| CVE-2021-44077US | critical9.8OT kritisch | KEV | ||
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Thi… | ||||
| CVE-2021-40539US | critical9.8OT kritisch | KEV | ||
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ||||
| CVE-2021-27065US | medium6.8OT kritisch | KEV | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
Gruppen (31)
Zugehörige Bedrohungsgruppen.
Software (22)
Zugehörige Malware und Tools.
Kampagnen (14)
Kampagnen, die dies verwenden.
Erkannt durch (Sigma) (35)
Zugehörige Sigma-Erkennungsregeln.
Quelle
Wo diese Definition veröffentlicht ist.