id: aem-xss-childlist info: name: Adobe Experience Manager Childlist Selector - Cross-Site Scripting author: theabhinavgaur severity: medium description: | Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the childlist selector when a dispatcher does not respect the content type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted in the browser. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cwe-id: CWE-80 metadata: verified: true shodan-query: - http.title:"AEM Sign In" - http.component:"Adobe Experience Manager" tags: xss,aem,adobe requests: - method: GET path: - "{{BaseURL}}/{{rand_base(4)}}.childrenlist.html" - "{{BaseURL}}/{{rand_base(4)}}

please%20authenticate

.childrenlist.html" stop-at-first-match: true matchers-condition: and matchers: - type: word part: body words: - '' - '

please authenticate

' condition: or - type: word part: body words: - 'data-coral-columnview-id' - type: word part: content_type words: - 'text/html' - type: status status: - 200 # Enhanced by md on 2023/03/08