A critical Server Side Request Forgery vulnerability in Eclipse GlassFish allows attackers to perform unauthorized requests, potentially leading to information disclosure or internal network scanning.

The vulnerability exists in specific endpoints of the GlassFish application server that fail to properly sanitize user-supplied input, enabling Server Side Request Forgery (SSRF). This allows an attacker to force the server to initiate unauthorized network requests to internal or external resources.

With a CVSS score of 9.8, this vulnerability is highly critical. Successful exploitation could allow an attacker to bypass firewalls, access internal services not exposed to the public internet, or perform reconnaissance on the internal network, significantly increasing the risk of further compromise.

Immediate Action: Apply the latest security patches or update to the version of Eclipse GlassFish recommended by the vendor that addresses SSRF vulnerabilities.

Proactive Monitoring: Monitor server access logs for requests to unusual or internal-only IP addresses and URLs that originate from the GlassFish application server.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block suspicious outbound requests originating from the application server environment.

Public Exploit Available: Unknown

Given the high CVSS score and the inherent risk of SSRF, immediate attention is required. Administrators should verify their current version of GlassFish and apply the necessary updates to prevent unauthorized access to internal network resources.