T1505.003 Web Shell
sub-techniqueEnterpriseAdversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Model
Detect
Isolate
Deceive
Evict
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlstrong · backed by 4 of 8 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 3 of 8 mapped controls
- PR.DSData Securitymoderate · backed by 3 of 8 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (8)
Security controls that mitigate this.
known-exploited CVEs (26)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-4427US | high7.5OT critical | KEV | ||
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the… | ||||
| CVE-2025-42999US | —OT critical | KEV | ||
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a… | ||||
| CVE-2025-35939US | medium5.3OT critical | KEV | ||
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Cra… | ||||
| CVE-2025-3928US | high8.8OT critical | KEV | ||
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised… | ||||
| CVE-2025-31324US | critical9.8OT critical | KEV | ||
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries tha… | ||||
| CVE-2024-21893US | high8.2OT critical | KEV | ||
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an att… | ||||
| CVE-2024-21887US | critical9.1OT critical | KEV | ||
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send special… | ||||
| CVE-2023-46805US | high8.2OT critical | KEV | ||
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing co… | ||||
| CVE-2023-32315US | high7.5OT critical | KEV | ||
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal… | ||||
| CVE-2023-20118US | high7.2OT critical | KEV | ||
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote att… | ||||
| CVE-2023-26360US | —OT critical | KEV | ||
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code… | ||||
| CVE-2023-22952US | high8.8OT critical | KEV | ||
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. | ||||
| CVE-2022-41082US | —OT critical | KEV | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2022-22954US | critical9.8OT critical | KEV | ||
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trig… | ||||
| CVE-2022-22963US | critical9.8OT critical | KEV | ||
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r… | ||||
| CVE-2021-44228US | critical10.0OT critical | KEV | ||
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai… | ||||
| CVE-2021-27860US | high8.8OT critical | KEV | ||
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker… | ||||
| CVE-2021-44077US | critical9.8OT critical | KEV | ||
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Thi… | ||||
| CVE-2021-40539US | critical9.8OT critical | KEV | ||
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ||||
| CVE-2021-27065US | medium6.8OT critical | KEV | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (31)
Threat groups associated with this.
software (22)
Malware and tools associated with this.
campaigns (14)
Campaigns that use this.
Detected by (Sigma) (35)
Sigma detection rules related to this.
source
Where this definition is published.