AEM Bug in Adobe

hi hackers

When I was sleeping in bed, I got the idea to look for security vulnerabilities in Adobe Hunting on them to find bugs

Adobe did have a bug bounty program hosted on the HackerOne platform

let’s check it

after doing some good recon (we will discuss the process in another post here don’t worry )

i have a lot of domains and do analysis for the technologies used in developing target-specific web applications.

i got a a lot of web technologies in adobe

web servers

domains run by php , domains run by java

The technology that caught my attention is AEM (Adobe Experience Manager).

AEM stands for Adobe Experience Manager. It is a comprehensive content management solution that enables organizations to create, manage, and deliver digital experiences across various channels, including websites, mobile apps, and forms. AEM is designed to help businesses effectively manage their digital content, streamline workflows, and personalize customer experiences.

The first thing I do before starting hunting.

I would like to understand how a web application works, what it does, and explore all its features as a regular user in the beginning to grasp a better understanding of its functionality and operations.

Initially, I wanted to understand how AEM works.

Adobe Experience Manager (AEM) has the following components and functionality:

Content Repository: Stores digital assets, content, and configurations using Apache Jackrabbit Oak.

OSGi Framework: Enables modular development and extensibility.

Authoring Environment: Web-based interface for content creation, editing, and workflow management.

Dispatcher: Caching and load balancing component that improves performance.

Publish Environment: Serves published content to end-users.

Integration and APIs: Integrates with Adobe Marketing Cloud solutions and offers APIs for customization and integration with external systems.

Scalability and Deployment: Supports horizontal scalability and cloud deployments for flexibility and scalability.

This architecture allows AEM to manage and deliver personalized digital experiences across multiple channels effectively.

try to run one

I found that some paths in the web application lack authentication because of a misconfiguration, allowing common users to make changes. Ideally, these edits should only be able to be made by granted administrators.

paths like these :

okay i have an idea

Let’s search for a wordlist that contain these endpoints

I found them.

https://github.com/clarkvoss/AEM-List/blob/main/paths?fbclid=IwAR1ifs59vpWJGDLkrNaEeWPx7LtH-e2BkZrKhA_IXVntlR1xBiR2G1PwVi0