CVE-2024-9408: Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints

The vulnerability is a Server-Side Request Forgery (SSRF) in the /download/log endpoint of Eclipse GlassFish 6.2.5. The root cause of the vulnerability is improper handling of the restUrl parameter, which allows an attacker to craft a malicious URI that can be used to access internal resources. The provided patch addresses this vulnerability by adding stricter normalization of the URI in the CoyoteAdapter class. The normalize, normalizeBytes, and normalizeChars functions were modified to detect and prevent path traversal attacks. The postParseRequest function was also modified to call the new normalize function and handle cases where normalization fails. These changes prevent the application from processing malicious URIs and mitigate the SSRF vulnerability.