CVE-2024-9329
📋 TL;DR
This vulnerability in Eclipse Glassfish allows attackers to redirect users to malicious websites via manipulated HTTP Host parameters when accessing the '/management/domain' endpoint. This enables phishing attacks to steal credentials. Organizations using Glassfish versions before 7.0.17 are affected.
💻 Affected Systems
- Eclipse Glassfish
📦 What is this software?
Glassfish by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Successful phishing campaign leading to credential theft, account compromise, and potential lateral movement within the network.
Likely Case
Credential harvesting from users who follow the malicious redirect, potentially leading to unauthorized access to the Glassfish management interface.
If Mitigated
Limited impact if users are trained to recognize phishing attempts and multi-factor authentication is enforced.
🎯 Exploit Status
Exploitation requires network access to the vulnerable endpoint but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.17
Vendor Advisory: https://github.com/eclipse-ee4j/glassfish/pull/25106
Restart Required: Yes
Instructions:
1. Download Glassfish 7.0.17 or later from official sources. 2. Stop the Glassfish server. 3. Backup configuration and deployed applications. 4. Install the updated version. 5. Restore configuration and applications. 6. Restart the server.
🔧 Temporary Workarounds
Restrict access to management endpoint
linuxBlock external access to the '/management/domain' endpoint using firewall rules or web server configuration.
iptables -A INPUT -p tcp --dport 4848 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 4848 -j DROP
Implement reverse proxy validation
allConfigure reverse proxy to validate and sanitize Host headers before forwarding to Glassfish.
🧯 If You Can't Patch
- Implement network segmentation to isolate Glassfish servers from user networks
- Deploy web application firewall rules to detect and block malicious redirect attempts
🔍 How to Verify
Check if Vulnerable:
Check Glassfish version via admin console or command: asadmin versionCheck Version:
asadmin versionVerify Fix Applied:
Confirm version is 7.0.17 or later using: asadmin version📡 Detection & Monitoring
Log Indicators:
- HTTP requests to '/management/domain' with unusual Host headers
- Multiple redirect responses from the management endpoint
Network Indicators:
- Unusual outbound connections from Glassfish server following management endpoint access
SIEM Query:
source="glassfish.log" AND (url_path="/management/domain" AND (host_header CONTAINS "malicious" OR status_code=302))