AEM Security Vulnerability

[avesh_narang]

Hello Everyone,

One of my clients is utilizing AEM Cloud, but our internal team has discovered a critical vulnerability that has not been communicated by the Adobe Cloud team.
Here are the steps to replicate the issue:

1. Launch a web browser.
2. Go to the URL: https://<domain>/bin/querybuilder.json;x='x/graphql/execute/json/'? path=/etc&p.hits=full&p.limit=-1
3. Notice that the endpoint can be accessed without any authentication.
4. This endpoint can be utilized to explore internal content structures by adjusting the query parameters accordingly.

I would like to know if anyone else has encountered this vulnerability. If so, how was it addressed?

Has Adobe Cloud provided a solution (please include the security patch number or Adobe link), or did your development team handle it?

Please share the details of any solutions that were implemented.

Note : Though I find the blog but need to understand which Adobe Security Patch is linked to it.

[TarunKumar]

HI @avesh_narang ,

May be you can try authenticating access to the AEM Query Builder and GraphQL endpoints, including the specific URL provided, using following methods:

• Session Establishment: 

  When accessing the /bin/querybuilder.json or GraphQL endpoints directly from within an AEM-managed environment (e.g., from a custom component or backend service), the request typically inherits the existing AEM user session.
  
  
• Login: 

  If the request is made from a context without an established AEM session (e.g., from a new browser window or a standalone Java application), the user will likely be redirected to the AEM login page to authenticate with valid credentials.

2. Dispatcher Filters (for AEM Headless deployments):

• Allow Rules: In AEM Headless deployments, the Dispatcher plays a crucial role in filtering requests. Configure Dispatcher filters to allow specific URLs and methods for GraphQL endpoints, such as:
  
  /0600 {
  /type "allow"
  /method '(POST|OPTIONS)'
  /url "/graphql/execute.json/*"
  }
  

-Tarun

[avesh_narang]

Thanks @TarunKumar ,

I see that this could be a possible solution, but there may be additional patterns that could bypass this validation.

Given that dispatcher settings are default when establishing the maven repository and affect all Adobe clients, Adobe might have encountered this issue and could provided a security patch for it.

I would appreciate community assistance in guiding me to the correct security patch, ensuring it is a foolproof solution and endorsed by Adobe.

Thanks