AEM Dispatcher handle bypass extension filter | Community
Skip to main content
T
teaevo
February 15, 2022
Solved

AEM Dispatcher handle bypass extension filter

  • February 15, 2022
  • 1 reply
  • 2125 views

Hi there,

 

I'm trying to set up our dispatcher, but realize attacker able to bypass the default filter by appending ";%0aJLN.ico" such as some of the endpoints affected like "https://website.com/check.jsp;%0aJLN.ico"

 

I realize this extension below allow the attacker to go through any extension listed.

"/0041 { /type "allow" /extension '(clientlibs|css|gif|ico|js|png|swf|jpe?g|woff2?)' } ".

 

Is there a way/fix to handle the bypass and what rule or extension should I use instead?

 

Any help you could provide would be much appreciated!

Thanks!

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by tb1687196

Hi @teaevo ,

Please consider removing "extension" from your filter section. For security reason you can implement below to allow the mime types. 

/0041 { /type "allow" /glob "* *.css *" } # enable css
/0042 { /type "allow" /glob "* *.gif *" } # enable gifs
/0043 { /type "allow" /glob "* *.ico *" } # enable icos
/0044 { /type "allow" /glob "* *.js* *" } # enable javascript (with ?querystrings)
/0045 { /type "allow" /glob "* *.png *" } # enable png
/0046 { /type "allow" /glob "* *.swf *" } # enable flash
/0047 { /type "allow" /glob "* *.svg *" } # enable SVG
/0048 { /type "allow" /glob "* *.woff *" } # enable woff
/0049 { /type "allow" /glob "* *.ttf *" } # enable ttf
/0050 { /type "allow" /glob "* *.eot *" } # enable eot
/0051 { /type "allow" /glob "* *.jpg *" } # enable jpg
/0052 { /type "allow" /glob "* *.otf *" } # enable otf

 

For details you can look into this link: https://labs.f-secure.com/blog/securing-aem-with-dispatcher/


1 reply

tb1687196
tb1687196Accepted solution
Level 2
February 15, 2022

Hi @teaevo ,

Please consider removing "extension" from your filter section. For security reason you can implement below to allow the mime types. 

/0041 { /type "allow" /glob "* *.css *" } # enable css
/0042 { /type "allow" /glob "* *.gif *" } # enable gifs
/0043 { /type "allow" /glob "* *.ico *" } # enable icos
/0044 { /type "allow" /glob "* *.js* *" } # enable javascript (with ?querystrings)
/0045 { /type "allow" /glob "* *.png *" } # enable png
/0046 { /type "allow" /glob "* *.swf *" } # enable flash
/0047 { /type "allow" /glob "* *.svg *" } # enable SVG
/0048 { /type "allow" /glob "* *.woff *" } # enable woff
/0049 { /type "allow" /glob "* *.ttf *" } # enable ttf
/0050 { /type "allow" /glob "* *.eot *" } # enable eot
/0051 { /type "allow" /glob "* *.jpg *" } # enable jpg
/0052 { /type "allow" /glob "* *.otf *" } # enable otf

 

For details you can look into this link: https://labs.f-secure.com/blog/securing-aem-with-dispatcher/


    T
    teaevoAuthor
    February 16, 2022

    Is there any alternate solution if I want on the same line like '(clientlibs|css|gif|ico|js|png|swf|jpe?g|woff2?)' ?

    tb1687196
    tb1687196
    Level 2
    February 16, 2022

    Hi @teaevo ,

    Your given lines i have segregated and given separately in the comment. In place of "extenstion" use that set. That holds the same meaning. 


    Terms & ConditionsAccessibility statement

    Loading footer...