1269
[REF-1327]Center for Internet Security. "CIS Google Cloud Computing Platform
Benchmark version 1.3.0". 2022 March 1. < https://www.cisecurity.org/benchmark/
google_cloud_computing_platform >.2023-04-24.
CWE-553: Command Shell in Externally Accessible Directory
Weakness ID : 553
Structure : Simple
Abstraction : Variant
Description
A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous
and can be used by an attacker to execute commands on the web server.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 552 Files or Directories Accessible to External Parties 1265
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
Potential Mitigations
Phase: Installation
Phase: System Configuration
Remove any Shells accessible under the web root folder and children directories.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Related Attack Patterns
CAPEC-ID Attack Pattern Name
650 Upload a Web Shell to a Web Server
CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework
Weakness ID : 554
Structure : Simple
Abstraction : Variant
CWE Version 4.14
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File