Adobe Experience Manager Felix Console Default Login Scanner

Adobe Experience Manager (AEM) is a comprehensive content management solution for building websites, mobile apps, and forms. It is widely used by businesses to manage and deliver digital experiences across different channels. AEM is developed by Adobe and is utilized by marketing teams to streamline content workflows and ensure brand consistency. Companies across various industries use it to create, manage, and personalize web content. Its flexibility and powerful features make it a preferred choice for enterprise-level digital marketing initiatives. By providing tools for digital asset management, AEM helps in delivering personalized content to users efficiently.

The default login vulnerability in Adobe Experience Manager Felix Console is a security flaw where default credentials (admin/admin) are not changed by users. This oversight can potentially provide unauthorized access to attackers, compromising sensitive data and operations. The vulnerability is associated with the web console's admin interface, exposing user accounts and confidential information to potential attacks. This type of vulnerability is common in systems where default settings remain unchanged, highlighting the need for secure configurations. Exploitation of this vulnerability could lead to unauthorized data modification, service disruption, and more.

In technical terms, the vulnerability exists within the Adobe Experience Manager Felix Console, specifically at endpoints like "/system/console/bundles". The default admin credentials provide potential access to sensitive backend controls. The risk increases as attackers can programmatically attempt logins to gain unauthorized access using automated scripts. The pathway involves cases where systems without monitored login attempts enable brute-force or default credentials exploitation. The endpoints' exposure in public interfaces without appropriate security measures elevates the risk of unauthorized access.

If exploited, this vulnerability could allow attackers to execute unauthorized operations within the AEM environment. They might gain access to confidential data, perform data manipulation, or even deploy malicious software. By utilizing default credentials, a malicious actor could disrupt company operations, leading to potential financial and reputational damage. Remote code execution could be possible through the installation of malicious OSGI bundles, further escalating the threat posed by this vulnerability.

REFERENCES

• https://github.com/0ang3el/aem-hacker/blob/master/aem_hacker.py
• https://github.com/0ang3el/aem-rce-bundle