CVE-2024-10032: Stored XSS Vulnerability in org.glassfish.main.admingui:console-cluster-plugin
Summary
CVE-2024-10032: Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console. Affects org.glassfish.main.admingui:console-cluster-plugin versions < 7.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.glassfish.main.admingui:console-cluster-plugin is a component of the Eclipse GlassFish application server, which provides a web-based administration console for managing server configurations and deployments. This plugin is essential for cluster management within GlassFish, allowing administrators to configure and monitor multiple server instances. However, it has been identified to have a vulnerability that exposes it to stored cross-site scripting (XSS) attacks, potentially compromising the security of the application and its users.
Vulnerability Detail
In Eclipse GlassFish version 7.0.15, a stored cross-site scripting (XSS) vulnerability exists through the Administration Console. This vulnerability allows an attacker to inject malicious scripts into the console, which can then be executed in the context of other users' browsers. The origin of this vulnerability lies in insufficient input validation and sanitization of user inputs. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to restrict access to the Administration Console to trusted users only. Additionally, implementing a web application firewall (WAF) can help mitigate the risk of XSS attacks by filtering out malicious requests.
Conclusion
The org.glassfish.main.admingui:console-cluster-plugin is vulnerable to stored XSS attacks, which can have serious implications for users and data security. It is crucial to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for org.glassfish.main.admingui:console-cluster-plugin →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected application.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground to analyze your pom.xml without any signup.
If exploited, this vulnerability can lead to unauthorized actions, data theft, session hijacking, and a significant compromise of user trust.
Yes, you can restrict access to the Administration Console and implement a web application firewall (WAF) to help filter out malicious requests.
More information can be found in the official advisory on GitHub or through security databases that track vulnerabilities.
