{
  "port": 4848,
  "protocol": "tcp",
  "service": "GlassFish / Payara admin console",
  "oneLiner": "The administration console of a GlassFish or Payara Java application server — full deployment control.",
  "whatItIs": "IANA registers 4848 as appserv-http, App Server Admin HTTP, and that is exactly what it is: the default admin listener of Sun/Oracle GlassFish, its Eclipse successor Eclipse GlassFish, and the Payara fork. The quick-start guide points administrators at http://localhost:4848, and the same port serves the asadmin CLI's remote commands. Whoever reaches it can deploy applications, which on a Java application server means running arbitrary code.",
  "exposure": {
    "verdict": "never",
    "note": "Deploying a WAR through this console is remote code execution by design; keep it on localhost or a management network, and never publish it even with authentication enabled."
  },
  "checkCommand": "curl -sk -o /dev/null -w '%{http_code}\\n' --max-time 5 https://TARGET:4848/",
  "links": [
    {
      "title": "Eclipse GlassFish Quick Start Guide — Administration Console on port 4848",
      "url": "https://glassfish.org/docs/latest/quick-start-guide.html",
      "kind": "official-docs"
    },
    {
      "title": "eclipse-ee4j/glassfish",
      "url": "https://github.com/eclipse-ee4j/glassfish",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 4848 (appserv-http)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4848",
      "kind": "iana"
    }
  ]
}