CVE-2024-9342: org.glassfish.main.admingui:console-common Vulnerable to Login Brute Force Attacks
Summary
CVE-2024-9342: Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts. Affects org.glassfish.main.admingui:console-common versions < 7.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse GlassFish is an open-source application server that provides a runtime environment for Java EE applications. It is designed to facilitate the development and deployment of web applications and services. The 'console-common' package is a key component of the GlassFish administration console, providing essential functionalities for managing server configurations and applications. However, versions 7.0.16 and earlier are susceptible to a critical security issue that allows unlimited failed login attempts, making it vulnerable to brute force attacks.
Vulnerability Detail
The vulnerability arises from the lack of restrictions on the number of failed login attempts in Eclipse GlassFish versions 7.0.16 and earlier. This oversight allows attackers to systematically guess user credentials without being locked out after a certain number of failed attempts. The potential ramifications include unauthorized access to sensitive server configurations and data, leading to possible data breaches or service disruptions. This vulnerability is classified under CWE-307, which pertains to the failure to restrict or control access to a resource.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement a custom login mechanism that limits the number of failed login attempts. This can be done by adding a counter that tracks failed attempts and locks the account after a predefined threshold is reached. Here is a simple example in Java:
public void login(String username, String password) {
if (failedAttempts >= MAX_ATTEMPTS) {
throw new AccountLockedException("Account is locked due to too many failed attempts.");
}
// Proceed with login logic
}
Conclusion
Eclipse GlassFish's vulnerability to login brute force attacks poses significant security risks. Users are strongly advised to update to the latest version of the affected package to mitigate these risks. Implementing additional security measures, such as limiting login attempts, can further enhance protection against unauthorized access.
See every vulnerability recorded for org.glassfish.main.admingui:console-common →
FAQ
CVE-2024-9342 is a vulnerability in Eclipse GlassFish that allows unlimited failed login attempts, making it susceptible to brute force attacks.
Eclipse GlassFish versions 7.0.16 and earlier are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using your pom.xml, you can check for vulnerabilities in real-time.
If immediate updates are not possible, implement a custom login mechanism to limit failed login attempts as a temporary workaround.
More information can be found in the official advisory on GitHub or by searching for CVE-2024-9342 in vulnerability databases.
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish.main.admingui:console-common.
