CVE-2024-10029: Reflected XSS Vulnerability in Eclipse GlassFish Console-common and Console-cluster-plugin
Summary
CVE-2024-10029: Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console. Affects org.glassfish.main.admingui:console-common versions < 7.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse GlassFish is an open-source application server that implements the Jakarta EE specifications. It provides a robust platform for developing and deploying Java EE applications. The affected packages, 'console-common' and 'console-cluster-plugin', are integral components of the GlassFish Administration Console, which allows administrators to manage server settings and applications. However, these packages are vulnerable to a reflected cross-site scripting (XSS) attack, which can compromise the security of the server and its applications.
Vulnerability Detail
In Eclipse GlassFish version 7.0.15, a reflected cross-site scripting (XSS) vulnerability exists within the Administration Console. This vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions, data theft, or session hijacking. The vulnerability arises from improper validation of user input, which can be exploited by crafting a specially crafted URL that includes malicious JavaScript code. If an administrator clicks on such a link, the script executes in their browser context, posing significant security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can implement input validation and sanitization on the server-side to mitigate the risk of XSS attacks. Additionally, avoid clicking on untrusted links or URLs that may contain malicious scripts.
Conclusion
The CVE-2024-10029 vulnerability in Eclipse GlassFish poses significant security risks due to its potential for reflected XSS attacks. It is crucial for users to update to the latest patched versions of the affected packages to safeguard their applications. Implementing workarounds can provide temporary relief, but timely updates are the best defense against such vulnerabilities.
See every vulnerability recorded for org.glassfish.main.admingui:console-common →
FAQ
A reflected XSS vulnerability allows an attacker to inject malicious scripts into web pages that are then executed in the user's browser, potentially leading to unauthorized actions or data theft.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
The risks include unauthorized access to sensitive data, session hijacking, and the potential for attackers to perform actions on behalf of the user.
Yes, a patch is available. Users should update to version 7.0.26 or later of the affected packages to mitigate the vulnerability.
If immediate updates are not possible, implement input validation and avoid clicking on suspicious links as a temporary measure to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish.main.admingui:console-common.
