CVE-2024-9408: Eclipse Glassfish SSRF Vulnerability

CVE-2024-9408 Overview

CVE-2024-9408 is a Server-Side Request Forgery (SSRF) vulnerability affecting Eclipse GlassFish application server. This vulnerability allows remote attackers to perform SSRF attacks through specific endpoints in GlassFish, potentially enabling unauthorized access to internal network resources, data exfiltration, or further lateral movement within the target environment.

Critical Impact

Remote attackers can exploit vulnerable GlassFish endpoints to send arbitrary requests to internal services, potentially bypassing network security controls and accessing sensitive internal resources.

Affected Products

• Eclipse GlassFish version 6.2.5 and later versions
• Eclipse GlassFish application server deployments exposed to untrusted network traffic
• Enterprise Java applications running on affected GlassFish versions

Discovery Timeline

• 2025-07-16 - CVE-2024-9408 published to NVD
• 2025-07-16 - Last updated in NVD database

Technical Details for CVE-2024-9408

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches a remote resource based on user-supplied input without properly validating the destination URL. In the context of Eclipse GlassFish, specific endpoints accept user-controlled parameters that influence outbound HTTP requests made by the server.

SSRF vulnerabilities in application servers are particularly concerning because these systems often have elevated network privileges and trusted positions within enterprise architectures. An attacker exploiting this vulnerability can potentially access internal services that are not directly accessible from external networks, including cloud metadata services, internal APIs, and administrative interfaces.

Root Cause

The root cause of CVE-2024-9408 lies in insufficient input validation within specific GlassFish endpoints that process URL parameters or references to external resources. The vulnerable endpoints fail to properly sanitize or restrict the destination of server-initiated requests, allowing attackers to specify arbitrary internal or external URLs.

This type of vulnerability commonly arises when:

• URL parameters are directly used in HTTP client requests without validation
• Allowlists for permitted destinations are absent or improperly implemented
• Internal network boundaries are not enforced at the application layer

Attack Vector

The attack vector for this vulnerability is network-based and does not require authentication or user interaction. An attacker can craft malicious HTTP requests to vulnerable GlassFish endpoints, embedding target URLs that point to internal resources.

Typical exploitation scenarios include:

1. Internal Service Discovery: Probing internal network ranges to identify running services
2. Cloud Metadata Access: Targeting cloud provider metadata endpoints (e.g., 169.254.169.254) to retrieve instance credentials
3. Internal API Abuse: Accessing internal REST APIs or administrative interfaces
4. Port Scanning: Using the GlassFish server as a proxy to scan internal network ports

The vulnerability manifests when user-supplied data influences the target URL of server-side HTTP requests. Technical details regarding specific vulnerable endpoints can be found in the Eclipse Security CVE Assignment Issue.

Detection Methods for CVE-2024-9408

Indicators of Compromise

• Unusual outbound HTTP requests from GlassFish servers to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• HTTP requests to cloud metadata endpoints such as 169.254.169.254 originating from the application server
• Abnormal traffic patterns showing GlassFish servers communicating with previously unknown internal services
• Log entries indicating requests to localhost or loopback addresses from external-facing endpoints

Detection Strategies

• Monitor GlassFish access logs for requests to endpoints that accept URL parameters, particularly those with unusual or internal destination addresses
• Implement network-level detection rules to alert on outbound connections from web application servers to sensitive internal resources
• Deploy web application firewalls (WAF) with SSRF detection capabilities to inspect and block malicious request patterns
• Review application logs for failed connection attempts to internal services that should not be accessible from the application tier

Monitoring Recommendations

• Configure network segmentation monitoring to detect unauthorized cross-zone communications from GlassFish servers
• Establish baseline network behavior for GlassFish deployments and alert on anomalous outbound connection patterns
• Enable verbose logging on GlassFish servers to capture full request details including URL parameters
• Integrate GlassFish logs with SIEM solutions for correlation with other network and security events

How to Mitigate CVE-2024-9408

Immediate Actions Required

• Identify all Eclipse GlassFish 6.2.5 and later deployments within your environment and assess their exposure to untrusted networks
• Implement network-level controls to restrict outbound connections from GlassFish servers to only necessary external destinations
• Deploy web application firewall rules to detect and block SSRF attack patterns targeting known vulnerable endpoints
• Review and restrict access to GlassFish administrative and sensitive endpoints from untrusted sources

Patch Information

Organizations should monitor the Eclipse GlassFish project for security updates addressing CVE-2024-9408. Consult the Eclipse Security CVE Assignment Issue for the latest information on available patches and remediation guidance from the vendor.

Apply security updates as soon as they become available and verify successful patching through vulnerability scanning.

Workarounds

• Implement strict egress filtering on network firewalls to prevent GlassFish servers from initiating connections to internal networks or sensitive external resources
• Configure application-level URL allowlists to restrict permitted destinations for server-side requests
• Place GlassFish servers in isolated network segments with minimal access to internal infrastructure
• Use a forward proxy for all outbound HTTP requests from GlassFish, implementing destination filtering and logging at the proxy layer

# Example iptables rules to restrict GlassFish outbound connections
# Block access to internal networks from GlassFish server
iptables -A OUTPUT -m owner --uid-owner glassfish -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner glassfish -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner glassfish -d 192.168.0.0/16 -j DROP

# Block access to cloud metadata endpoint
iptables -A OUTPUT -m owner --uid-owner glassfish -d 169.254.169.254 -j DROP