Setting local Name and Port for /managment/* URI

[luiseufrasio]

Description

It is possible to trick the Glassfish’s management REST interface by “injecting” a malicious URL via the Host header of a sample request to let the HTML page that is generated by the REST interface when the /management/domain endpoint is targeted.

Important Info

Blockers

None

Testing

New tests

None

Testing Performed

Steps:

1. run Glassfish
2. on Powershell run:

Invoke-RestMethod -Method Get -Uri http://local:4848/management/domain
-Headers @{
'Accept' = 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8'
'Accept-Encoding' = 'gzip, deflate, br'
'Accept-Language' = 'en-US,en;q=0.5'
'Host' = 'google.com'
} > result.html

3. Open file result.html
4. Check that google.com is not in the URLs

Testing Environment

Zulu JDK 17 Windows 11 with Maven 3.9.0

Documentation

None

Notes for Reviewers

[dmatej]

Thanks, just tiny issue with checkstyle rules:
15:25:37 [ERROR] src/main/java/org/glassfish/admin/rest/adapter/RestManagementAdapter.java:[22,1] (imports) ImportOrder: Wrong order for 'org.glassfish.admin.restconnector.Constants' import.

Just move those two new imports below Constants (alphabet)