Apache Sling Framework (Adobe AEM) 2.3.6 - Information Disclosure

Document Title:
===============
Apache Sling Framework v2.3.6 (Adobe AEM) [CVE-2016-0956] - Information Disclosure Vulnerability

 
Adobe Bulletin: https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html
 
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0956
 
Vulnerability Magazine: http://magazine.vulnerability-db.com/?q=articles/2016/02/10/apache-sling-fw-v236-remote-slingpostservlet-exception-vulnerability
 
 
CVE-ID:
=======
CVE-2016-0956
 
 
Release Date:
=============
2016-02-10
 
 
Product & Service Introduction:
===============================
Apache Sling is a web framework that uses a Java Content Repository, such as Apache Jackrabbit, to store and manage content. Sling applications use either scripts 
or Java servlets, selected based on simple name conventions, to process HTTP requests in a RESTful way. The embedded Apache Felix OSGi framework and console provide 
a dynamic runtime environment, where code and content bundles can be loaded, unloaded and reconfigured at runtime. As the first web framework dedicated to JSR-170 
Java Content Repositories, Sling makes it very simple to implement simple applications, while providing an enterprise-level framework for more complex applications.
 
(Copy of the Vendor Homepage:  http://sling.apache.org/)
 
 
Adobe Experience Manager (AEM) provides a complete suite of applications for the Web Experience Management (WEM) of organizations.
 
(Copy of the Vendor Homepage: https://docs.adobe.com/docs/en/aem/6-1.html )
 
 
Discovery Status:
=================
Published
 
 
Affected Product(s):
====================
Apache Software Foundation
Product: Apache Sling - Framework (Adobe AEM) 2.3.6

 
 
Technical Details & Description:
================================
It seems that on some instances of AEM, due to lack of proper security controls and or misconfiguration, it is possible for remote unauthenticated 
users to enumerate local system files/folders that arent accessible publicly to unauthenticated users.
 
This can be achieved by sending a `delete` requests to the SlingPostServlet which in return, responds back with a 500 exception page and the 
following exception message: (org.apache.sling.api.resource.PersistenceException - Unable to commit changes to session)
 
No actual files are deleted with this request however, the HTML response contains a `ChangeLog` field which is where all enumerated folder/file 
names are displayed (if existing). For instance, following POC command can be used to reproduce the said behavior.
 
curl -F``:operation=delete`` -F``:applyTo=/foldername/*`` http://website.com/path/file.html
 
To reproduce this in real world, I found an adobe website which is currently affected with this behavior. You can use the following CURL command 
to reproduce the POC:
 
curl -F``:operation=delete`` -F``:applyTo=/etc/*`` https://server/content/adobedemolab/welcome-page.html
 
Note: This curl command should enumerate all files/folders which currently exist in /etc folder
 
This vulnerability currently affects major websites i.e. almost every instance of Adobe AEM published on the internet. Some references are included below for reference.
 
Affected Framework(s):
Apache Sling
 
Affected Product(s)
Adobe AEM (All Versions)
 
 
Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by remote attackers without privilege system user account or user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
 
PoC:
1. curl -F":operation=delete" -F":applyTo=/foldername/*" http://website.com/path/file.html
2. curl -F":operation=delete" -F":applyTo=/etc/*" https://www.adobedemo.com/content/adobedemolab/welcome-page.html
 
 
Solution - Fix & Patch:
=======================
The vulnerability is fixed in version Servlets POST 2.3.8. Please update by by automatic request or implement the manual fix.
 
Adobe: Hot fix 6445 resolves an information disclosure vulnerability affecting Apache Sling Servlets Post 2.3.6 (CVE-2016-0956).
 
 
Security Risk:
==============
The security risk of the exception software vulnerability in the apache sling framework is estimated as high. (CVSS 6.4)

#  0day.today [2018-01-04]  #