Web Exploitation: Server-Side Attacks That Reach RCE

TopicsWeb application penetration testing Download PDF

TL;DR

This section covers the server-side web vulnerabilities that most often escalate to serious impact: injection into templates, queries, and shells; parsers that betray trust; and request-boundary confusion. Each explainer names the technique, shows how it is detected and abused, and gives the control that closes it. For the client-side and access-control classes, see the Application Security section.

By Pranav Khune, Lead Pentester, SecureLayer7Updated July 6, 2026

Topics

What is Server-Side Template Injection (SSTI)?: user input evaluated as template code, usually reaching remote code execution.
What is Insecure Deserialization?: rebuilding objects from hostile bytes, and the gadget chains that follow.
What is XXE?: an XML parser that resolves external entities, becoming file read and server-side request forgery.
What is OS Command Injection?: user input reaching a system shell, the most direct route to server control.
What are File Upload Vulnerabilities?: from an uploaded file to a web shell and full compromise.
What is HTTP Request Smuggling?: front-end and back-end disagreeing on request boundaries.
What is LFI and RFI?: controlling which file an application includes, to read data or run code.
What is NoSQL Injection?: operator injection that bypasses authentication and extracts data.

Named RCE vulnerabilities: the X2Shell family

Some remote code execution flaws get a name because one bug in a ubiquitous component exposes a large share of the internet at once. Start with the family guide, then read the one you are patching:

What are X2Shell vulnerabilities?: the family guide: what the Shell names mean and how to respond when the next one lands.
What is PHP2Shell?: two pre-auth RCE flaws in PHP core (CVE-2026-109618, CVE-2026-109619).
What is Node2Shell?: a Brotli decoder out-of-bounds write inside Node.js (CVE-2026-111497).
What is HTTP2Shell?: the same Brotli bug in Python and other HTTP stacks.
What is the Brotli RCE?: the Brotli decoder flaw behind Node2Shell and HTTP2Shell, every affected ecosystem in one place.
What is React2Shell?: unauthenticated RCE in React Server Components and Next.js (CVE-2025-55182).
What is Plex2Shell?: a four-bug Plex Media Server chain from SSRF to code execution (CVE-2026-96652 and related).
What is Log4Shell?: one logged string, a JNDI lookup and remote code in Apache Log4j 2 (CVE-2021-44228).
What is Spring4Shell?: Spring data binding reaching the class loader (CVE-2022-22965).
What is Text4Shell?: script lookups in Apache Commons Text interpolation (CVE-2022-42889).
What is ProxyShell?: three chained Microsoft Exchange flaws, plus ProxyNotShell.
What is ToolShell?: pre-auth RCE in on-premises SharePoint and stolen machine keys (CVE-2025-53770).
What is ShellTorch?: an exposed TorchServe model server loading attacker models (CVE-2023-43654).
What is Shellshock?: the 2014 Bash flaw that started the naming trend (CVE-2014-6271).

How to read this section

Every explainer follows the same shape: what the flaw is, how it is detected and abused with real payloads shown for defensive context, and how to close it. The payloads are here to help defenders recognize and reproduce the issue, not to weaponize it. If you want these tested against your own application with reproducible evidence and a developer-ready report, that is what web application penetration testing delivers.