Skip to main content
protocols.pageprotocols.page
4848

Port 4848 – GlassFish Admin

TCP

Port 4848 is the GlassFish (Payara) application server administration console port. The admin console on port 4848 provides full server control – deploying applications, configuring JDBC pools, managing JVM settings. Default installations allow unauthenticated local access. Never expose port 4848 to untrusted networks.

Port Number

4848

Protocol

TCP

Service

GlassFish Application Server Admin

Range

IANA Registered (1024–49151)

Description

GlassFish (and its supported fork Payara Server) uses port 4848 for the administration web console and REST API. Through this port, administrators deploy Java EE applications, configure resources (JDBC, JMS, mail sessions), tune JVM parameters, and manage clustering. By default, GlassFish allows unauthenticated access to the admin console from localhost and requires a password only for remote connections. Many development installations never set an admin password, creating a critical vulnerability if port 4848 becomes reachable. Attackers who reach port 4848 can deploy malicious WAR files for immediate remote code execution. Set a strong admin password, enable secure admin (asadmin enable-secure-admin), and restrict port 4848 to management networks.

Security risks

  • 1CVE-2017-1000028: Oracle GlassFish directory traversal – unauthenticated attacker reads arbitrary files on the server via crafted URL to admin console (CVSS 7.5)
  • 2No admin password by default: fresh GlassFish installations allow admin console access from localhost without any password – Docker containers binding to 0.0.0.0 expose this to the network
  • 3WAR deployment RCE: admin console access allows deploying arbitrary WAR files (Java web applications) – equivalent to remote code execution with application server privileges
  • 4JMX exposed through admin port: GlassFish's JMX MBeans accessible via the admin interface allow runtime reconfiguration, thread manipulation, and diagnostics data extraction
  • 5EOL product: Oracle GlassFish Server (commercial) reached end of life. Community Edition (Eclipse GlassFish) has limited security response. Payara is the actively maintained fork

Firewall guidance

Port 4848 must ONLY be accessible from admin workstations. Immediately set an admin password: asadmin change-admin-password. Enable secure admin (TLS): asadmin enable-secure-admin. Bind admin listener to localhost: in domain.xml set address='127.0.0.1' for the admin-listener. Never expose 4848 to the internet – WAR deployment = RCE.

Diagnosis commands

Test if GlassFish admin REST API is accessible without auth

shell
curl -s http://localhost:4848/management/domain.xml | head -5

List GlassFish domains and their status

shell
asadmin list-domains

Check if admin console is enabled

shell
asadmin get server.admin-service.das-config.admin-console-enabled

Verify GlassFish admin port binding address

shell
ss -tlnp | grep 4848

Usage examples

Port 4848 – GlassFish Admin
shell
asadmin start-domain domain1
curl http://localhost:4848/management/domain
asadmin enable-secure-admin

Common services on this port

Eclipse GlassFishPayara ServerOracle GlassFish (EOL)Oracle Application Server (legacy)

Related ports

4848

GlassFish admin (this port)

8080

GlassFish HTTP listener

8181

GlassFish HTTPS listener

4949

Munin monitoring (similar port range)

History

GlassFish was Sun Microsystems' Java EE reference implementation (2005). Port 4848 was chosen for the admin console. Oracle acquired Sun (2010) and eventually discontinued commercial GlassFish support (2013). Eclipse Foundation took over the open-source version. Payara (2014) forked GlassFish for commercial support with active security patching. Most new Java deployments use Spring Boot (embedded server, no admin port) or Quarkus.

FAQ

GlassFish vs Payara vs WildFly vs Tomcat?

GlassFish: Jakarta EE reference implementation, minimal commercial support, OK for development/testing. Payara: actively maintained GlassFish fork with enterprise support, security patches, and Kubernetes-native features. WildFly (JBoss): Red Hat's Jakarta EE server, strong in enterprises using RHEL/OpenShift. Tomcat: servlet container only (not full Jakarta EE), lightest weight. For new projects: consider Spring Boot (no app server needed) or Quarkus (cloud-native).