Eclipse Equinox OSGi RCE: Critical Vulnerability Exposes Consoles to Unauthenticated Attackers

The National Vulnerability Database has issued an alert for CVE-2023-54344, a critical remote code execution (RCE) vulnerability in Eclipse Equinox OSGi 3.7.2 and earlier. This flaw allows unauthenticated attackers to execute arbitrary commands by sending specially crafted payloads to the OSGi console interface. The CVSS score of 9.8 reflects the severe implications, as attackers can achieve full system compromise without prior authentication.

Attackers can exploit this by connecting to the exposed OSGi console port and delivering base64-encoded bash commands, often wrapped in fork directives. This technique facilitates command execution and, critically, allows for establishing reverse shell connections. The ease of exploitation combined with the lack of authentication makes this a high-priority threat for any organization running vulnerable versions of Eclipse Equinox OSGi.

While specific affected products were not detailed by the National Vulnerability Database, any system integrating Eclipse Equinox OSGi should be considered at risk. The vulnerability, classified under CWE-306 (Missing Authentication for Critical Function), underscores a fundamental security lapse that threat actors are quick to leverage. Defenders need to act decisively to mitigate this exposure.