CVE-2024-36184
📋 TL;DR
This DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager allows attackers to execute arbitrary JavaScript in victims' browsers when users interact with malicious content. It affects AEM versions 6.5.20 and earlier. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- Adobe Experience Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data theft, or malicious actions performed as authenticated users if combined with other vulnerabilities.
Likely Case
Session hijacking, credential theft, or defacement of user-facing content.
If Mitigated
Limited impact due to user interaction requirement and proper input validation/sanitization.
🎯 Exploit Status
Requires user interaction (clicking malicious link or submitting crafted form).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.21 or later
Vendor Advisory: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
Restart Required: Yes
Instructions:
1. Download AEM 6.5.21 or later from Adobe Distribution portal. 2. Apply the Service Pack following Adobe's upgrade documentation. 3. Restart AEM instances. 4. Verify successful update.
🔧 Temporary Workarounds
Content Security Policy (CSP)
allImplement strict CSP headers to restrict script execution from untrusted sources.
Add 'Content-Security-Policy' header with appropriate directives
Input Validation
allImplement server-side validation and sanitization of all user inputs.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with XSS protection rules
- Restrict user access to only trusted domains and implement clickjacking protection
🔍 How to Verify
Check if Vulnerable:
Check AEM version via CRXDE Lite or OSGi console. If version is 6.5.20 or earlier, system is vulnerable.Check Version:
curl -u admin:password http://localhost:4502/system/console/status-productinfoVerify Fix Applied:
Verify AEM version is 6.5.21 or later and test XSS payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript payloads in request logs
- Suspicious form submissions with script tags
Network Indicators:
- Requests containing script injection patterns
- Unusual redirects to external domains
SIEM Query:
source="aem-access.log" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")