CVE-2025-12548

CRITICAL

Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-12548 has a selected CVSS score of 9.0 (critical); EIP currently links 1 catalogued exploit.

Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 15, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 13, 2026 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

Red Hat OpenShift Dev Spaces (RHOSDS) 3.22

Browse Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.22devspaces/code-rhel9

Default status: affected

CVE Listsha256:3de7dd8077a9201eb7ff56c340629184773d6c06de9d6e083e13c5b51a82009c to < *unaffected

Red Hat OpenShift Dev Spaces (RHOSDS) 3.22

Browse Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
VulnCheckVersion data not supplied

Red Hat OpenShift Dev Spaces (RHOSDS) 3.23

Browse Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.23devspaces/code-rhel9

Default status: affected

CVE Listsha256:a6fe7e233fa23e1fff9c74c5d4cbe800534561131b5be59533e88ede24452e3a to < *unaffected

Red Hat OpenShift Dev Spaces (RHOSDS) 3.24

Browse Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.24devspaces/code-rhel9

Default status: affected

CVE Listsha256:ced0e45c01cb5f473deb4fb137249b743b907d27172fbabd223024c4000ba56f to < *unaffected

Proofs of concept

1

Catalogued exploits

MetasploitEclipse Che machine-exec Unauthenticated RCEMetasploit exploitby Greg Durys <gregdurys.security@proton.me> +1 moreExploit1 file

Ruby

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-12548, an unauthenticated RCE in Eclipse Che machine-exec service, by sending a JSON-RPC create request over WebSocket to execute arbitrary commands.

Backdoor review

No backdoor observed in reviewed code

The supplied Metasploit module source code implements a standard exploit for CVE-2025-12548. It connects to the vulnerable machine-exec service via WebSocket, sends a JSON-RPC 'create' request with the attacker's chosen command, and triggers execution by attaching to the created process. No concealed executable behavior, credential theft, persistence, or unrelated payload delivery was observed. The module's actions are consistent with its documented purpose of achieving remote code execution on the target.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareEclipse Che machine-exec
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module includes a complete exploit method that connects to the target, stages a payload via JSON-RPC, and triggers its execution, which is the definition of exploit code.

modules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:187-194modules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:196-269

Requirements

  • Network access to the machine-exec service on TCP port 3333modules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:67-68
  • Target must be running a vulnerable version of Eclipse Che machine-execmodules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:20-22

Observed behavior

  • Establishes an unauthenticated WebSocket connection to the machine-exec servicemodules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:94-148
  • Sends a JSON-RPC create request with attacker-supplied command to stage executionmodules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:215-225
  • Triggers command execution by connecting to the attach endpoint with the returned process IDmodules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:257-262
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the documented exploit mechanism for CVE-2025-12548 and matches the module's description.modules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:196-269
Payload Delivery
Payload withheldThe module delivers the attacker-chosen payload via the exploited service, which is normal for a Metasploit exploit module.modules/exploits/linux/http/eclipse_che_machine_exec_rce.rb:187-194
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include any execution output or confirmation that the exploit was successfully run.
  • Review is limited to the supplied module source code. The behavior of included Metasploit framework mixins (e.g., Msf::Exploit::Remote::HttpClient, Msf::Exploit::CmdStager) and the final payloads (e.g., cmd/unix/reverse_bash) is not expanded or analyzed.
  • The module's metadata and CVE context were reviewed but are not executable code; they are consistent with the module's stated purpose.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

6