CVE-2024-43732
📋 TL;DR
Adobe Experience Manager versions 6.5.21 and earlier contain a DOM-based Cross-Site Scripting vulnerability that allows attackers to execute arbitrary JavaScript in victims' browsers when they click malicious links. This affects all users of vulnerable AEM instances. The vulnerability requires user interaction to exploit.
💻 Affected Systems
- Adobe Experience Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals session cookies, performs actions as authenticated users, or redirects to phishing sites, potentially leading to account compromise and data theft.
Likely Case
Session hijacking, credential theft, or defacement of web pages through injected content.
If Mitigated
Limited impact due to same-origin policy restrictions and user interaction requirement, but still enables client-side attacks.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but no authentication to the AEM instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.22 or later
Vendor Advisory: https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
Restart Required: Yes
Instructions:
1. Download AEM 6.5.22 or later from Adobe Distribution. 2. Backup current instance. 3. Apply the update following Adobe's upgrade documentation. 4. Restart the AEM service.
🔧 Temporary Workarounds
Content Security Policy (CSP)
allImplement strict CSP headers to prevent execution of inline scripts and restrict script sources.
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
Input Validation Filter
allDeploy custom servlet filter to sanitize user inputs before DOM processing.
Implement javax.servlet.Filter to sanitize request parameters
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block XSS payloads
- Educate users about phishing risks and suspicious links
🔍 How to Verify
Check if Vulnerable:
Check AEM version via /system/console/status-productinfo endpoint or crx-quickstart/logs/error.log for version information.Check Version:
curl -k https://<aem-host>:<port>/system/console/status-productinfo | grep 'Adobe Experience Manager'Verify Fix Applied:
Confirm version is 6.5.22 or later and test XSS payloads are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript in request parameters
- Multiple failed XSS attempts in access logs
Network Indicators:
- Requests containing script tags or JavaScript in URL parameters
SIEM Query:
source="aem_access.log" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=")