Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The che-machine-exec service, used in Eclipse Che workspaces, is affected by this flaw. When it runs with authentication disabled (its default setting), a remote attacker on the network can run arbitrary commands inside the containers it manages, potentially taking full control of those containers.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
Affected versions
- Eclipse Foundation Eclipse Che
From 7.0.0 · through 7.122.0