Eclipse GlassFish versions 8.0.0 before 8.0.4 contain a vulnerability classified as CWE-918 (Server-Side Request Forgery). The issue arises from CSRF combined with SSRF in the DownloadServlet ContentSources, which leaks the administrative 'gfresttoken' to an attacker-controlled host when the victim is authenticated in the Admin Console. This token leakage enables an attacker to gain full control over the Eclipse GlassFish domain without authentication until the token expires. The CVSS 3.1 base score is 9.6, indicating a critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

An attacker can achieve full unauthenticated takeover of the Eclipse GlassFish domain by exploiting this vulnerability. The attack requires the victim to be authenticated in the Admin Console, but no privileges or prior authentication are needed by the attacker. The compromise lasts until the leaked admin token expires, potentially allowing complete control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the Admin Console to trusted users only and monitor for suspicious activity involving the DownloadServlet. Avoid exposing the Admin Console to untrusted networks. Follow the vendor advisory for updates on remediation.