Making QueryBuilderFeedServlet private | Community
Skip to main content
K
Kerryu1
Level 2
July 27, 2023
Solved

Making QueryBuilderFeedServlet private

  • July 27, 2023
  • 1 reply
  • 916 views

After doing a vulnerability scan we found the following vulnerability. How can I make the page not publicly accessible? It doesn't even mention what the page address is for this. I'm trying to find references to the servlet right now but am having a hard time. 

 

Adobe Experience Manager QueryBuilderFeedServlet page is publicly accessible. Sensitive information might be exposed via AEM's QueryBuilderFeedServlet.

 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Saravanan_Dharmaraj

@kerryu1 Please check the below post which has the similar query

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/should-not-respond-to-get-bin-querybuilder-feed-css-with-200/m-p/326310

 

you can try like this in your dispatcher filter rules, "wknd" is sample site

 

##This rule must be the last rule to block content grabbing in all paths
/9997 { /type "deny" /url "/content/dam/*" /suffix "*/bin/querybuilder.json*"}
/9998 { /type "deny" /url "/content/wknd/*" /suffix "*/bin/querybuilder.json*"}

  

1 reply

K
Kerryu1Author
Level 2
July 27, 2023

Update: I found the feed to be accessible via '/bin/querybuilder.feed' url. What would be the best approach to making this private? I don't know if it's a crucial endpoint for end users or not as well.

    Saravanan_Dharmaraj
    Community Advisor
    Saravanan_DharmarajCommunity AdvisorAccepted solution
    Community Advisor
    July 28, 2023

    @kerryu1 Please check the below post which has the similar query

    https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/should-not-respond-to-get-bin-querybuilder-feed-css-with-200/m-p/326310

     

    you can try like this in your dispatcher filter rules, "wknd" is sample site

     

    ##This rule must be the last rule to block content grabbing in all paths
    /9997 { /type "deny" /url "/content/dam/*" /suffix "*/bin/querybuilder.json*"}
    /9998 { /type "deny" /url "/content/wknd/*" /suffix "*/bin/querybuilder.json*"}

      

      Terms & ConditionsAccessibility statement

      Loading footer...