A critical Server Side Request Forgery (SSRF) vulnerability in Eclipse GlassFish 6.2.5 enables attackers to potentially access unauthorized internal services.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring in specific endpoints, allowing unauthenticated attackers to force the server to make unauthorized requests to internal resources.

Successful exploitation of this SSRF vulnerability could allow an attacker to bypass firewalls, probe internal network services, or access sensitive metadata services that are otherwise unreachable from the internet. Given the critical CVSS score of 9.8, this flaw represents a significant risk to the confidentiality and integrity of the internal network architecture.

Immediate Action: As no specific fix version is currently listed, administrators should restrict access to the GlassFish administration interface to trusted networks only.

Proactive Monitoring: Review web server and application logs for anomalous requests to internal IP addresses or unusual outbound traffic patterns originating from the GlassFish server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or inspect requests targeting vulnerable endpoints and prevent unauthorized outbound connections.

Public Exploit Available: Unknown

Organizations should immediately isolate the affected GlassFish instances from public-facing networks. Monitor for upcoming vendor security updates and apply them as soon as they become available to eliminate the SSRF risk.