sc-rce

name	sc-rce
description	Remote Code Execution detection via eval, exec, dynamic code loading, and code injection vectors
license	MIT
metadata	{"author":"ersinkoc","category":"security","version":"1.0.0"}

SC: Remote Code Execution (RCE)

Purpose

Detects remote code execution vulnerabilities where user-controlled input reaches functions that evaluate or execute code dynamically. Covers eval-based injection, dynamic function construction, script engine execution, template code execution, and code loading from untrusted sources. This skill focuses on code evaluation mechanisms beyond command injection (covered by sc-cmdi) and deserialization (covered by sc-deserialization).

Activation

Called by sc-orchestrator during Phase 2. Runs against all detected languages.

Phase 1: Discovery

Keyword Patterns to Search

# Python
"eval(", "exec(", "compile(", "__import__(", "importlib.import_module(",
"builtins.__import__", "code.InteractiveInterpreter", "ast.literal_eval"

# JavaScript/Node.js
"eval(", "Function(", "setTimeout(.*string", "setInterval(.*string",
"vm.runInNewContext(", "vm.runInThisContext(", "vm.createContext(",
"require(.*variable", "import(.*variable", "new Function("

# PHP
"eval(", "assert(", "create_function(", "preg_replace(.*/e",
"call_user_func(", "call_user_func_array(", "array_map(",
"usort(.*\\$", "include(.*\\$", "require(.*\\$"

# Java
"ScriptEngine", "ScriptEngineManager", "Nashorn", "GraalVM",
"GroovyShell", "GroovyClassLoader", "javax.script",
"MethodHandle", "ClassLoader.loadClass"

# C#
"CSharpCodeProvider", "Roslyn", "Microsoft.CodeAnalysis",
"Assembly.Load(", "Activator.CreateInstance(",
"Type.GetType(.*variable", "DynamicMethod"

# Go
"plugin.Open(", "yaegi", "go/ast"

# Ruby
"eval(", "instance_eval(", "class_eval(", "module_eval(",
"send(.*variable", "public_send(", "method("

Data Flow Tracing

Trace user input to any dynamic code evaluation function. Key patterns:

• HTTP parameter → variable → eval()
• Database value (originally user input) → code execution function
• Configuration file (user-editable) → dynamic import/require
• WebSocket message → eval-like function

Phase 2: Verification

Python Examples

# VULNERABLE: eval with user input
result = eval(request.GET['expression'])

# VULNERABLE: exec with user input
exec(request.POST['code'])

# SAFE: ast.literal_eval for safe subset
import ast
result = ast.literal_eval(request.GET['data'])  # Only parses literals

# SAFE: Restricted evaluation with custom namespace
allowed_names = {"abs": abs, "min": min, "max": max}
result = eval(expression, {"__builtins__": {}}, allowed_names)
# Note: Still risky — sandbox escapes are possible

JavaScript Examples

// VULNERABLE: eval with user input
const result = eval(req.body.expression);

// VULNERABLE: Function constructor
const fn = new Function('return ' + req.body.code);

// VULNERABLE: vm module (escapable sandbox)
const vm = require('vm');
vm.runInNewContext(req.body.code, sandbox);

// SAFE: Use a math parser library instead
const mathjs = require('mathjs');
const result = mathjs.evaluate(req.body.expression);

PHP Examples

// VULNERABLE: eval
eval($_POST['code']);

// VULNERABLE: Dynamic function call
$func = $_GET['action'];
$func(); // Calls arbitrary function

// SAFE: Allowlist of functions
$allowed = ['view', 'edit', 'delete'];
if (in_array($_GET['action'], $allowed)) {
    $func = $_GET['action'];
    $func();
}

Severity Classification

• Critical: Direct eval/exec/Function with HTTP request input, no sandbox or restrictions
• High: Code execution through framework features (ScriptEngine, vm module) with user input
• Medium: Dynamic code execution with partial restrictions or requiring authenticated access
• Low: eval with constant expressions, or vm module with timeout but no network restriction

Output Format

Finding: RCE-{NNN}

• Title: Remote Code Execution via {eval|Function|exec|ScriptEngine} in {location}
• Severity: Critical | High | Medium | Low
• Confidence: 0-100
• File: file/path:line
• Vulnerability Type: CWE-94 (Code Injection) | CWE-95 (Eval Injection)
• Description: User input from {source} reaches {code execution function} allowing arbitrary code execution.
• Impact: Complete server compromise, data theft, lateral movement, persistent backdoor.
• Remediation: Remove eval/exec usage. Use safe parsing libraries. Implement strict allowlisting.
• References: https://cwe.mitre.org/data/definitions/94.html

Common False Positives

1. eval with constants — eval("1+2") with no user input is not exploitable
2. ast.literal_eval — Python's literal_eval only parses literal values (safe for simple data)
3. Template engine rendering — template engines are covered by sc-ssti, not this skill
4. Build/dev tooling — webpack, babel, jest using eval internally for build purposes
5. REPL/debug tools — eval in development REPL tools not deployed to production
6. Math expression parsers — libraries like mathjs safely evaluate mathematical expressions