AEM Security Vulnerability

[avesh_narang]

Hello Everyone,

One of my clients is utilizing AEM Cloud, but our internal team has discovered a critical vulnerability that has not been communicated by the Adobe Cloud team.
Here are the steps to replicate the issue:

1. Launch a web browser.
2. Go to the URL: https://<domain>/bin/querybuilder.json;x='x/graphql/execute/json/'? path=/etc&p.hits=full&p.limit=-1
3. Notice that the endpoint can be accessed without any authentication.
4. This endpoint can be utilized to explore internal content structures by adjusting the query parameters accordingly.

I would like to know if anyone else has encountered this vulnerability. If so, how was it addressed?

Has Adobe Cloud provided a solution (please include the security patch number or Adobe link), or did your development team handle it?

Please share the details of any solutions that were implemented.

Note : Though I find the blog but need to understand which Adobe Security Patch is linked to it.

[TarunKumar]

HI @avesh_narang ,

May be you can try authenticating access to the AEM Query Builder and GraphQL endpoints, including the specific URL provided, using following methods:

• Session Establishment: 

  When accessing the /bin/querybuilder.json or GraphQL endpoints directly from within an AEM-managed environment (e.g., from a custom component or backend service), the request typically inherits the existing AEM user session.
  
  
• Login: 

  If the request is made from a context without an established AEM session (e.g., from a new browser window or a standalone Java application), the user will likely be redirected to the AEM login page to authenticate with valid credentials.

2. Dispatcher Filters (for AEM Headless deployments):

• Allow Rules: In AEM Headless deployments, the Dispatcher plays a crucial role in filtering requests. Configure Dispatcher filters to allow specific URLs and methods for GraphQL endpoints, such as:
  
  /0600 {
  /type "allow"
  /method '(POST|OPTIONS)'
  /url "/graphql/execute.json/*"
  }
  

-Tarun