Eclipse GlassFish Remote Code Execution Vulnerability via Expression Language Injection

A critical remote code execution vulnerability has been identified in Eclipse GlassFish versions 8.0.0 and prior to 7.1.0. This vulnerability arises in the server-side template rendering of the Glassfish gadget handler, where the application processes .xml files and evaluates user-supplied values using Expression Language (EL). The issue stems from improper sanitization and escaping of EL expressions, allowing remote attackers to inject and execute arbitrary code. Exploitation of this vulnerability could lead to full compromise of the underlying host, including unauthorized data access and modification, execution of arbitrary commands, persistence, and lateral movement within the network.

Impact

Exploitation of this vulnerability allows for remote code execution on the server, with the potential for full system compromise.