Patchfirst
Patchfirst
T1505.003Persistence

Web Shell

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a…

attack.mitre.org ↗
CVEs41
In 35
Reports3

Detections

35 Sigma rules tagged T1505.003
Web ShellT1505.00335 general rules
All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Web Shell

41 CVEs, by priority. Each link shows its badge.
  1. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote ServicesT1505.003Web Shell+2 more · 5 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    89.4priority
  3. CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
    Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reports
    MITRE CTID mapping of the KEV entry · primary impact
    99.9%Top 0.03%
    88.8priority
  4. CVE-2025-52691SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
    SmarterTools · SmarterMailKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    AI mapping from the description · primary impact
    85.7%Top 0.28%
    88.8priority
  5. CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
    Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 4 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    88.4priority
  6. CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
    Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 more · 4 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.02%
    87.7priority
  7. CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell4 reports
    MITRE CTID mapping of the KEV entry · primary impact
    99.9%Top 0.04%
    87.4priority
  8. CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 3 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.03%
    86.9priority
  9. CVE-2021-26857Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell3 reports
    MITRE CTID mapping of the KEV entry · primary impact
    95.8%Top 0.13%
    86.2priority
  10. CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
    Progress · Telerik UI for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 1 report
    MITRE CTID mapping of the KEV entry · primary impact
    99.7%Top 0.05%
    83.7priority
  11. CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
    Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 report
    MITRE CTID mapping of the KEV entry · primary impact
    99.0%Top 0.07%
    83.7priority
  12. CVE-2025-31324SAP NetWeaver Unrestricted File Upload Vulnerability
    SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1505.003Web Shell+2 more · 1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.5%Top 0.06%
    83.7priority
  13. CVE-2023-32315Ignite Realtime Openfire Path Traversal Vulnerability
    Ignite Realtime · OpenfireKEVPublic exploitHigh · 7.5T1505.003Web ShellT1202Indirect Command Execution+2 more · 1 report
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    82.1priority
  14. CVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwareHigh · 7.8T1505.003Web Shell3 reports
    MITRE CTID mapping of the KEV entry · primary impact
    93.7%Top 0.16%
    81.2priority
  15. CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
    VMware · Workspace ONE Access and Identity ManagerKEVRansomwarePublic exploitCritical · 9.8T1505.003Web Shell
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    79.9priority
  16. CVE-2022-41352Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    AI mapping from the description · primary impact
    95.5%Top 0.13%
    79.8priority
  17. CVE-2017-12615Apache Tomcat on Windows Remote Code Execution Vulnerability
    Apache · TomcatKEVRansomwarePublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    AI mapping from the description · primary impact
    99.7%Top 0.05%
    78.7priority
  18. CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
    Ivanti · Connect Secure, Policy Secure, and NeuronsKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    78.7priority
  19. CVE-2022-41082Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.0T1078Valid AccountsT1059.001PowerShell+4 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.02%
    78.6priority
  20. CVE-2025-42999SAP NetWeaver Deserialization Vulnerability
    SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    12.9%Top 3.7%
    78.6priority
  21. CVE-2018-4063Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
    Sierra Wireless · AirLink ALEOSKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    AI mapping from the description · primary impact
    27.3%Top 1.9%
    73.8priority
  22. CVE-2021-27860FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
    FatPipe · WARP, IPVPN, and MPVPN softwareKEVPublic exploitHigh · 8.8T1505.003Web Shell1 report
    MITRE CTID mapping of the KEV entry · primary impact
    39.7%Top 1.4%
    72.8priority
  23. CVE-2017-12617Apache Tomcat Remote Code Execution Vulnerability
    Apache · TomcatKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    AI mapping from the description · primary impact
    >99.9%Top 0.02%
    72.5priority
  24. CVE-2022-22963VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
    VMware Tanzu · Spring CloudKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.007JavaScript+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.9%Top 0.03%
    69.9priority
  25. CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
    Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more
    MITRE CTID mapping of the KEV entry · primary impact
    93.3%Top 0.16%
    69.8priority
  26. CVE-2024-11680ProjectSend Improper Authentication Vulnerability
    ProjectSend · ProjectSendKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098Account Manipulation+1 more
    AI mapping from the description · primary impact
    91.8%Top 0.18%
    69.8priority
  27. CVE-2023-22952Multiple SugarCRM Products Remote Code Execution Vulnerability
    SugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    80.1%Top 0.38%
    69.1priority
  28. CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
    Adobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    97.3%Top 0.1%
    69.0priority
  29. CVE-2025-4427Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
    Ivanti · Endpoint Manager Mobile (EPMM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.9%Top 0.03%
    68.2priority
  30. CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
    Zoho · ManageEngineKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    AI mapping from the description · primary impact
    63.3%Top 0.79%
    67.4priority
  31. CVE-2023-20118Cisco Small Business RV Series Routers Command Injection Vulnerability
    Cisco · Small Business RV Series RoutersKEVHigh · 7.2T1078Valid AccountsT1059Command and Scripting Interpreter+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    54.1%Top 1%
    62.8priority
  32. CVE-2021-36741Trend Micro Multiple Products Improper Input Validation Vulnerability
    Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business SecurityKEVHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    AI mapping from the description · primary impact
    5.0%Top 7.8%
    62.6priority
  33. CVE-2024-39717Versa Director Dangerous File Type Upload Vulnerability
    Versa · DirectorKEVHigh · 7.2T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    AI mapping from the description · primary impact
    4.0%Top 9.5%
    61.1priority
  34. CVE-2025-3928Commvault Web Server Unspecified Vulnerability
    Commvault · Web ServerKEVHigh · 8.8T1059Command and Scripting InterpreterT1505.003Web Shell
    MITRE CTID mapping of the KEV entry · follow-on activity
    2.5%Top 15%
    61.1priority
  35. CVE-2025-35939Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
    Craft CMS · Craft CMSKEVMedium · 5.3T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    1.3%Top 29%
    56.0priority
  36. CVE-2020-12029Rockwell Automation FactoryTalk View SE
    Rockwell Automation · FactoryTalk View SEPublic exploitCritical · 9.0T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the CVE · primary impact
    47.0%Top 1.2%
    31.1priority
  37. CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
    Cisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 more
    MITRE CTID mapping of the CVE · primary impact
    38.7%Top 1.4%
    26.6priority
  38. CVE-2020-15189Remote Code Execution in SOY CMS
    inunosinsi · soycmsMedium · 6.8T1059Command and Scripting InterpreterT1505.003Web Shell
    MITRE CTID mapping of the CVE · primary impact
    2.8%Top 14%
    22.1priority
  39. CVE-2020-5297Upload whitelisted files to any directory in OctoberCMS
    octobercms · octoberPublic exploitLow · 3.4T1059Command and Scripting InterpreterT1505.003Web Shell
    MITRE CTID mapping of the CVE · primary impact
    1.2%Top 32%
    20.9priority
  40. CVE-2020-11010SQL injection in Tortoise ORM
    tortoise · tortoise-ormMedium · 6.3T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.0%Top 36%
    17.2priority
  41. CVE-2019-18234Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…
    T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.9%Top 20%
    15.9priority

Passages that support these links

CVE-2019-19781

The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781.
Iran-Based Threat Actor Exploits VPN Vulnerabilities cisa.gov Original (opens in a new tab) ↗

CVE-2024-21887

Following the successful exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection), UNC5221 leveraged multiple custom malware families including the ZIPLINE passive backdoor, THINSPOOL dropper, LIGHTWIRE web shell, and WARPWIRE credential harvester.
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation cloud.google.com Original (opens in a new tab) ↗

CVE-2023-46805

Following the successful exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection), UNC5221 leveraged multiple custom malware families including the ZIPLINE passive backdoor, THINSPOOL dropper, LIGHTWIRE web shell, and WARPWIRE credential harvester.
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation cloud.google.com Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close