CVE-2018-14324
📋 TL;DR
This vulnerability in Oracle GlassFish Open Source Edition 5.0's demo feature leaves TCP port 7676 open with default credentials (admin/admin), allowing remote attackers to access JMX RMI services. Attackers can obtain sensitive information, perform database operations, or manipulate the demo environment. Organizations using GlassFish 5.0 with demo features enabled are affected.
💻 Affected Systems
- Oracle GlassFish Open Source Edition
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including data theft, database manipulation, and potential lateral movement within the network.
Likely Case
Unauthorized access to sensitive configuration data, application manipulation, and potential privilege escalation.
If Mitigated
Limited to unauthorized access to demo features only, with no impact on production data or systems.
🎯 Exploit Status
Default credentials and open port make exploitation trivial; JMX RMI provides extensive access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://github.com/eclipse-ee4j/glassfish/issues/22500
Restart Required: Yes
Instructions:
1. Disable demo features. 2. Change default credentials. 3. Close port 7676 if not needed. 4. Consider upgrading to supported versions.
🔧 Temporary Workarounds
Disable Demo Feature
allRemove or disable the demo feature from GlassFish installation.
Remove demo applications from $GLASSFISH_HOME/glassfish/domains/domain1/applications/
Change Default Credentials
allChange the default admin password from 'admin' to a strong, unique password.
asadmin change-admin-password --domain_name domain1
Firewall Port 7676
linuxBlock TCP port 7676 at network perimeter and host firewall.
iptables -A INPUT -p tcp --dport 7676 -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate GlassFish servers
- Deploy intrusion detection systems to monitor port 7676 traffic
🔍 How to Verify
Check if Vulnerable:
Check if port 7676 is open: 'netstat -tlnp | grep 7676' or 'nmap -p 7676 <host>'Check Version:
$GLASSFISH_HOME/bin/asadmin versionVerify Fix Applied:
Verify port 7676 is closed and cannot be accessed remotely; confirm demo features are disabled.📡 Detection & Monitoring
Log Indicators:
- Unauthorized JMX RMI connections on port 7676
- Failed authentication attempts with default credentials
Network Indicators:
- Inbound connections to TCP port 7676 from untrusted sources
- JMX RMI protocol traffic
SIEM Query:
source_port=7676 OR dest_port=7676 OR protocol="JMX RMI"