CVE-2025-54253 PoC — Adobe Experience Manager 安全漏洞

介绍

   # CVE-2025-54253 - Adobe AEM Forms RCE Exploit

   ## Overview
   CVE-2025-54253 is a critical remote code execution vulnerability in Adobe Experience Manager (AEM) Forms on JEE. It stems from an authentication bypass in the `/adminui` module, combined with Apache Struts development mode enabled by default in some setups, allowing attackers to inject and execute OGNL expressions.

   ## CVE Information
   - **CVE Assigned:** CVE-2025-54253
   - **CVE Published State:** PUBLISHED
   - **CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2025-54253

   ## Description
   An authentication bypass vulnerability exists in Adobe Experience Manager (AEM) Forms on JEE due to a misconfiguration in the `/adminui` module, combined with Apache Struts development mode enabled by default in some setups. This allows attackers to inject and execute OGNL expressions, leading to remote code execution (RCE) on the underlying system without authentication.

   ## Impact
   1. Full compromise of the server, including execution of arbitrary system commands.
   2. Gaining persistent access to the system.
   3. Exfiltration of sensitive data.
   4. Using the compromised host to pivot within the network.

   ## Attack Scenario
   1. Attacker identifies a vulnerable AEM Forms instance.
   2. Exploits the authentication bypass in the `/adminui` module.
   3. Injects an OGNL expression to execute arbitrary commands.
   4. Gains control over the server and performs malicious actions.

   ## Technical Details
   - **Vulnerability Type:** Authentication Bypass, Remote Code Execution
   - **CWE Classification:** CWE-287 – Improper Authentication, CWE-917 – Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
   - **Attack Type:** Remote

   ## Affected Versions
   - Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23 and earlier.

   ## Vendor Information
   - **Vendor:** Adobe
   - **Website:** https://www.adobe.com/

   ## Proof of Concept (PoC)
   1. Intercept the HTTP request to the `/adminui` module.
   2. Inject an OGNL expression to execute a command, such as listing directory contents.
   3. Example hypothetical payload (not an actual working script):
      ```
      GET /lc/libs/foundation/component/redirect?url=%25%7b%28%27ls%20-l%27%29%5b%40java.lang.Runtime%40getRuntime%28%29.exec%28%27ls%27%29%5d%7d HTTP/1.1
      ```
   4. POC at - http://bit.ly/457kRJG

   ## Disclaimer
   This repository is for **educational and authorized testing purposes only**. Do not use the information or code on systems without explicit permission. The author is not responsible for any misuse or damage.

文件快照

备注