Listen to this Post
Eclipse GlassFish version 7.0.15 is vulnerable to Stored Cross-Site Scripting (XSS) attacks via its Administration Console. The vulnerability arises due to improper input sanitization in user-supplied data fields, allowing attackers to inject malicious JavaScript payloads. When an administrator views the compromised data in the console, the script executes in their browser session. This can lead to session hijacking, unauthorized actions, or data theft. The flaw exists in the handling of request parameters and lacks proper output encoding, making it exploitable through crafted HTTP requests.
DailyCVE Form:
Platform: Eclipse GlassFish
Version: <= 7.0.25
Vulnerability: Stored XSS
Severity: Moderate
Date: Jul 16, 2025
Prediction: Patch expected by Aug 15, 2025
What Undercode Say:
Check GlassFish version asadmin version Exploit PoC (simulated malicious request) curl -X POST -d "param=<script>alert(1)</script>" http://target:4848/admin-console Verify patch (post-update) grep "XSS" glassfish/modules/security-core.jar
How Exploit:
- Craft a malicious script payload.
- Inject via Administration Console input fields.
- Trigger execution when admin views the compromised data.
Protection from this CVE:
- Upgrade to patched version (when released).
- Implement input validation/output encoding.
- Restrict admin console access to trusted IPs.
Impact:
- Session hijacking.
- Unauthorized administrative actions.
- Data exfiltration.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
