Hello Everyone,
One of my clients is utilizing AEM Cloud, but our internal team has discovered a critical vulnerability that has not been communicated by the Adobe Cloud team.
Here are the steps to replicate the issue:
- Launch a web browser.
- Go to the URL: https://<domain>/bin/querybuilder.json;x='x/graphql/execute/json/'? path=/etc&p.hits=full&p.limit=-1
- Notice that the endpoint can be accessed without any authentication.
- This endpoint can be utilized to explore internal content structures by adjusting the query parameters accordingly.
I would like to know if anyone else has encountered this vulnerability. If so, how was it addressed?
Has Adobe Cloud provided a solution (please include the security patch number or Adobe link), or did your development team handle it?
Please share the details of any solutions that were implemented.
Note : Though I find the blog but need to understand which Adobe Security Patch is linked to it.
