nuclei-templates/misconfiguration/aem/aem-userinfo-servlet.yaml

id: aem-userinfo-servlet

info:
  author: DhiyaneshDk
  name: AEM  UserInfo Servlet
  severity: info
  description: UserInfoServlet is exposed, it allows to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node.
  tags: aem


requests:
  - method: GET
    path:
      - '{{BaseURL}}/libs/cq/security/userinfo.json'
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"userID":'
          - '"userName":'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'
Create aem-userinfo-servlet.yaml 2021-04-13 08:50:14 +00:00			`id: aem-userinfo-servlet`

			`info:`
			`author: DhiyaneshDk`
			`name: AEM UserInfo Servlet`
Update aem-userinfo-servlet.yaml 2021-04-13 20:31:02 +00:00			`severity: info`
Create aem-userinfo-servlet.yaml 2021-04-13 08:50:14 +00:00			`description: UserInfoServlet is exposed, it allows to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node.`
			`tags: aem`


			`requests:`
			`- method: GET`
			`path:`
			`- '{{BaseURL}}/libs/cq/security/userinfo.json'`
			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 200`

			`- type: word`
Strict matchers 2021-06-10 15:48:38 +00:00			`part: body`
Create aem-userinfo-servlet.yaml 2021-04-13 08:50:14 +00:00			`words:`
Strict matchers 2021-06-10 15:48:38 +00:00			`- '"userID":'`
			`- '"userName":'`
Create aem-userinfo-servlet.yaml 2021-04-13 08:50:14 +00:00			`condition: and`
Strict matchers 2021-06-10 15:48:38 +00:00
			`- type: word`
			`part: header`
			`words:`
			`- 'application/json'`