9.8Kritisch
CVE-2023-54342Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution
Beschreibung
Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet connection to the OSGi console, perform a telnet handshake, and send fork commands to download and execute malicious Java code, establishing a reverse shell connection.
Schwachstellentyp (CWE):
CWE-306
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| eclipse | equinox | 3.8 – ≤ 3.18 | |
| Eclipse | Equinox OSGi | 3.8 – ≤ 3.18 |
Referenzen und Patches
- ExploitDB-51878 exploit
- VulnCheck Advisory: Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution third-party-advisory