aem-jcr-exposure: Adobe AEM JCR Compare Exposure

id: aem-jcr-exposure

info:
  name: Adobe AEM JCR Compare Exposure
  author: pussycat0x
  severity: medium
  description: |
    Detected an exposed Adobe AEM JCR compare functionality that was accessible without proper authorization. This exposure may have allowed attackers to infer repository structure or sensitive content through comparison operations.
  reference:
    - https://experienceleague.adobe.com/docs/experience-manager-65/administering/security/security-checklist.html
    - https://medium.com/@vsr061/adobe-experience-manager-security-issues-9b5bd24e0eb0
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"Adobe Experience Manager"
  tags: aem,adobe,exposure,misconfiguration,jcr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jcr:content.json"
      - "{{BaseURL}}/etc/replication/agents.author/publish/jcr:content.json"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains_all(body, "jcr:createdBy", "cq:template")
        condition: and
# digest: 4a0a00473045022078822eb9dc4da01e3549353cbb9d5d83b17876a655be6700b9e6f2f7c850bec202210098772a15cdc1d9a016eb8e10ce1257e1c588b98a464f9f93eda74912447f120d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.