Brief Summary: CVE-2023-54342 — Unauthenticated RCE in Eclipse Equinox OSGi Console via Fork Command

Introduction

An unauthenticated telnet console that accepts commands from anyone on the network is already a bad day waiting to happen. Give that console a built-in way to download and execute arbitrary code, and you get CVE-2023-54342, a CVSS 9.8 remote code execution vulnerability in Eclipse Equinox OSGi versions 3.8 through 3.18 that is already weaponized with public exploits.

Eclipse Equinox is the reference implementation of the OSGi core framework specification. It is the runtime foundation for all of Eclipse IDE and ships with every major Eclipse release, so its deployment footprint is enormous across enterprise development environments, embedded systems, and any product built on the Eclipse platform. Equinox sits deep inside downstream toolchains, which gives a vulnerability in its console component a blast radius well beyond Eclipse IDE itself.

Technical Information

Root Cause: Missing Authentication for Critical Function (CWE-306)

When enabled, the OSGi console's management interface accepts telnet connections with no authentication of any kind. Users typically enable it by starting the OSGi core with a command-line option or configuration property that defines a listening port. A common misconfiguration binds the console to all network interfaces (0.0.0.0), so it accepts connections from any IP address on the network.

Once connected over telnet, an attacker has full access to the console's command set. Two commands matter here: exec and fork. Exploitation hinges on fork, which executes a system command in a separate process without waiting for results. That lets attackers work around the console's interactive constraints and its restrictions on command chaining.

Attack Flow

On OSGi versions 3.8 through 3.18, an attacker has to get past two obstacles: a required telnet connection handshake, and the console's restrictions on command chaining or pipes. The attack proceeds in stages:

1. The attacker connects to the OSGi console on the target system's listening port and completes the required telnet handshake sequence.

2. On their own system, the attacker prepares a Java source file containing code that, when compiled and executed, opens a reverse shell connection back to them.

3. The attacker starts an HTTP server on their own machine to host the malicious Java file.

4. In the first stage, the attacker sends a fork command through the console that tells the target system to download the Java payload file from the attacker's HTTP server.

5. In the second stage, another fork command compiles and executes the downloaded Java file on the target system, which establishes the reverse shell.

Staging the attack this way gets around the console's built-in command limits. The result is a fully functional reverse shell, with interactive access to the underlying operating system at the privileges of the Equinox process.

Weaponization

The barrier to exploitation is extremely low. VisionSpace Technologies published a complete exploit script on Exploit DB (EDB ID 51878) that automates the entire telnet handshake and payload delivery. Rapid7 has also published a Metasploit module ("Eclipse Equinox OSGi Console Command Execution") that turns the exploit into a point-and-click tool for penetration testers and, inevitably, threat actors.

Affected Systems and Versions

The vulnerability affects Eclipse Equinox OSGi versions 3.8 through 3.18 when the console interface is enabled and reachable over the network.

Specific vulnerable configurations include:

• Any Equinox deployment where the OSGi console is enabled via the osgi.console property with a port binding
• Deployments where the console is bound to 0.0.0.0 or any externally reachable interface
• Systems using the telnet console without firewall restrictions limiting source IP addresses
• Any downstream application or product embedding the Equinox runtime with the console enabled

Mitigation Strategies

Organizations should act now to secure or disable the OSGi console. These are the options, ordered from most to least restrictive:

1. Disable the console entirely by setting osgi.console=none in the configuration file. This is the most effective mitigation if production operations do not need the console.

2. Bind telnet to localhost only with osgi.console=localhost:1234. This prevents external network access and limits exposure to local processes.

3. Enable SSH with authentication by using the osgi.console.ssh configuration and setting up JAAS-based user authentication or public key-based authentication. This replaces the unauthenticated telnet interface with a properly authenticated SSH session.

4. Restrict network traffic with dedicated firewall rules that allow connections to the console port only from specific, trusted administrative IP addresses.

If the console has to stay enabled for operational reasons, moving from unauthenticated telnet to SSH sessions with proper authentication is strongly recommended. Use network segmentation so the console is reachable only from dedicated administrative workstations.

Threat Intelligence

Because exploit code is public, attackers of any skill level can act on this vulnerability immediately. The Exploit DB script (EDB ID 51878) and the Rapid7 Metasploit module are both turnkey and need minimal customization.

At the time of writing, no specific advanced persistent threat group has been publicly attributed as actively exploiting CVE-2023-54342. Even so, a high CVSS score, unauthenticated access, and ready-made exploit tooling make opportunistic exploitation highly likely. Defenders should watch for inbound connections to OSGi console ports, fork command execution in console logs, and unexpected outbound connections from systems running Equinox.

References

• VulnCheck Advisory: Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution
• Exploit DB: OSGi v3.8-3.18 Console RCE (EDB ID 51878)
• Rapid7: Eclipse Equinox OSGi Console Command Execution Metasploit Module
• VisionSpace Technologies: Exploitation of the OSGi Console
• Eclipse Bug 169603: Option to Disable Builtin Console
• Eclipse Help: Console Shell Documentation
• Mat Booth: Using the Remote OSGi Console with Equinox
• Eclipse Equinox Project Page
• Eclipse Equinox GitHub Repository