Expand my Community achievements bar.

Radically easy to access on brand approved content for distribution and omnichannel performant delivery. AEM Assets Content Hub and Dynamic Media with OpenAPI capabilities is now GA.

Hackers found vulnerabilities with 'form' selector


Level 7


hi folks,


Hackers told us that they can access various urls using a selector "form".

We don't have AEM forms so I am just going to get rid of this selector like this,

I assume this is o.k.?


/0xxx { /type "deny" /url "*" /selectors 'form' }


The hackers told us they could download a truststore file with this url below. However if i look in our Tools -> Security -> Trust store  UI,

it is empty as I never put anything into it.




Do you reckon the file is just   junk? It is just 1K file and looks like Chinese chars.


thanks all

6 Replies


Community Advisor

Yes, The above rule will work to deny any requests or block requests with the 'form' selector.


Did you get a chance to check the logs to get more details on the hackers URL - find out how they were able to download a trust store file.

Generaly - The truststore file is used to store certificates that the client trusts. If you haven't added any certificates to it, it should be empty. However, it's concerning that hackers were able to download it. Even if it's empty, it's a security risk to expose it.

Check your dispatcher and AEM configurations to ensure that they don't allow unauthorized access to sensitive paths like /etc/truststore path.


Level 7

Thanks Suresh, 

They seem to be able to use the .form. selector to break into the system.

I don't know why that selector allows it.

I don't know if blocking the .form. selector would break AEM forms if you had them(we don't)

Once I block the .form. selector, they can't get at /etc/truststore anymore.

I will try to add some extra rules for /etc/truststore also.


Community Advisor

HI @fionas76543059 
Generally, we denied everything and only whitelist what should be allowed in the filter files

e.g. https://github.com/arunpatidar02/aemaacs-aemlab/blob/master/dispatcher.cloud/src/conf.dispatcher.d/f...


you can disable all the other rules if not in used.

Arun Patidar


Level 1

But still urls like -  test.pdf/jcr:content.form./crx/packmgr/service.jsp/file.res/file.zip will be allowed 

since it's the suffix here

suffix : /jcr:content.form./crx/packmgr/service.jsp/file.res/file.zip



Community Advisor

You can block this paths using rewrite rules



RewriteRule ^(.+)\.pdf/.*$ $1.pdf [L,R=301]


Arun Patidar



@fionas76543059 Did you find the suggestions from users helpful? Please let us know if more information is required. Otherwise, please mark the answer as correct for posterity. If you have found out solution yourself, please share it with the community.

Kautuk Sahni