Eclipse GlassFish ist anfällig für Server Side Request Forgery Angriffe über bestimmte Endpunkte

The SSRF vulnerability in GlassFish allows an attacker to craft malicious requests that the server will execute on behalf of the attacker. This can be used to scan internal networks, access sensitive data stored within the GlassFish environment (such as configuration files or database credentials), or even interact with other internal services. Successful exploitation could lead to unauthorized access to internal resources, data breaches, and potentially, a foothold for further attacks within the network. While direct remote code execution is unlikely, the ability to interact with internal services through SSRF can be a significant risk, especially in environments with poorly secured internal systems.

Organizations running GlassFish version 6.2.5 or earlier, particularly those with sensitive data stored within the GlassFish environment or exposed through internal services, are at risk. Shared hosting environments utilizing GlassFish are also vulnerable, as they may lack the ability to independently patch the underlying server software.

• java / server: Monitor GlassFish server logs for unusual outbound requests, particularly those targeting internal IP addresses or sensitive endpoints. Use network monitoring tools to detect suspicious traffic originating from the GlassFish server.

journalctl -u glassfish | grep -i "request to"

• generic web: Use a web application firewall (WAF) to filter outbound requests and block those that appear malicious. Configure the WAF to inspect HTTP headers and request bodies for suspicious patterns. • generic web: Check access logs for requests to unusual or unexpected internal endpoints. • generic web: Examine response headers for signs of SSRF exploitation, such as redirects to internal resources.

1. 2025-07-16Disclosure

   disclosure

1. Reserviert2024-10-01
2. Veröffentlicht2025-07-16
3. Geändert2025-07-18
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-9408 is to upgrade to GlassFish version 6.2.6 or later, which includes the necessary fix. If upgrading immediately is not possible, consider implementing temporary workarounds. These may include restricting outbound network access from the GlassFish server using a firewall or proxy server, limiting the endpoints accessible through the admin console, and carefully reviewing and restricting any user-supplied input that could be used to construct malicious requests. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability using the previously identified attack vectors and verifying that the requests are now blocked or redirected.