CVE-2025-12548: Eclipse Che RCE Vulnerability

CVE-2025-12548 Overview

A critical vulnerability has been identified in Eclipse Che che-machine-exec that allows unauthenticated remote arbitrary command execution and secret exfiltration from other users' Developer Workspace containers. The flaw exists in an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333, enabling attackers to execute commands and steal sensitive data including SSH keys and tokens without authentication.

Critical Impact

This vulnerability enables unauthenticated attackers to execute arbitrary commands remotely and exfiltrate sensitive secrets (SSH keys, tokens, credentials) from other users' Developer Workspace containers, potentially compromising entire development environments and supply chains.

Affected Products

• Eclipse Che che-machine-exec component
• Red Hat OpenShift Dev Spaces (affected versions addressed in RHSA-2025:22620)
• Red Hat OpenShift Dev Spaces (affected versions addressed in RHSA-2025:22623)

Discovery Timeline

• January 13, 2026 - CVE-2025-12548 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-12548

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The che-machine-exec component in Eclipse Che exposes a JSON-RPC API over WebSocket connections on TCP port 3333. This API is designed to provide terminal/command execution capabilities within Developer Workspace containers. However, the critical flaw is that this API endpoint lacks proper authentication mechanisms, allowing any network-accessible attacker to connect and execute arbitrary commands.

The attack surface is particularly dangerous in multi-tenant development environments where multiple users share the same infrastructure. An attacker exploiting this vulnerability can pivot between workspace containers, accessing sensitive developer credentials, SSH private keys, API tokens, and other secrets stored in the development environment.

Root Cause

The root cause stems from missing authentication controls on the JSON-RPC/WebSocket API endpoint exposed by che-machine-exec on TCP port 3333. The service was implemented without requiring authentication before processing command execution requests, violating the principle of secure-by-default design. This allows any client that can establish a network connection to the exposed port to interact with the API and execute commands within workspace containers.

Attack Vector

The vulnerability is exploitable over the network by any unauthenticated attacker who can reach TCP port 3333 on the che-machine-exec service. The attack flow involves:

1. An attacker identifies an exposed Eclipse Che instance with the vulnerable che-machine-exec component
2. The attacker establishes a WebSocket connection to port 3333
3. Without any authentication challenge, the attacker sends JSON-RPC requests to execute arbitrary commands
4. Commands execute within Developer Workspace containers, enabling file access, secret exfiltration, and further lateral movement

The attack can be executed remotely without user interaction, though the attacker requires low-level privileges to initiate the network connection. Successful exploitation impacts confidentiality and integrity across security boundaries (changed scope), as attackers can access other users' workspaces.

Detection Methods for CVE-2025-12548

Indicators of Compromise

• Unexpected WebSocket connections to TCP port 3333 on che-machine-exec services
• Unusual JSON-RPC requests or command execution patterns in workspace containers
• Unauthorized access to files containing SSH keys, tokens, or credentials within developer workspaces
• Anomalous outbound data transfers from workspace containers that may indicate secret exfiltration

Detection Strategies

• Monitor network traffic for unexpected connections to TCP port 3333 from external or unauthorized sources
• Implement logging and alerting on JSON-RPC/WebSocket API calls to che-machine-exec services
• Review container logs for unusual command execution patterns or access to sensitive files
• Deploy network segmentation monitoring to detect lateral movement between workspace containers

Monitoring Recommendations

• Enable comprehensive audit logging for all Eclipse Che and che-machine-exec components
• Configure alerts for authentication failures or unauthorized API access attempts
• Implement file integrity monitoring for SSH key directories and token storage locations in developer workspaces
• Monitor for unusual process spawning within workspace containers that may indicate command injection

How to Mitigate CVE-2025-12548

Immediate Actions Required

• Apply the latest security patches from Red Hat immediately (see RHSA-2025:22620, RHSA-2025:22623, RHSA-2025:22652)
• Restrict network access to TCP port 3333 using firewall rules or network policies
• Audit existing developer workspaces for signs of compromise or unauthorized access
• Rotate any SSH keys, tokens, or credentials that may have been exposed in affected environments

Patch Information

Red Hat has released multiple security advisories addressing this vulnerability:

• Red Hat Security Advisory RHSA-2025:22620
• Red Hat Security Advisory RHSA-2025:22623
• Red Hat Security Advisory RHSA-2025:22652

For detailed CVE analysis and tracking information, refer to the Red Hat CVE Analysis for CVE-2025-12548 and Red Hat Bug Report #2408850.

Workarounds

• Implement network policies to block external access to TCP port 3333 on che-machine-exec services
• Deploy reverse proxy or API gateway with authentication in front of the vulnerable endpoint
• Isolate Eclipse Che deployments in network segments with strict ingress/egress controls
• Consider temporarily disabling the che-machine-exec component if terminal functionality is not critical

# Example: Block external access to port 3333 using iptables
iptables -A INPUT -p tcp --dport 3333 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3333 -j DROP

# Example: Kubernetes NetworkPolicy to restrict che-machine-exec access
# Apply this to limit traffic to the vulnerable service
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-che-machine-exec
spec:
  podSelector:
    matchLabels:
      app: che-machine-exec
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: che-server
    ports:
    - protocol: TCP
      port: 3333
EOF