Collected research

A story of the passive aggressive sysadmin of AEM

Frans Rosén · Speaker Deck · 13 September 2018

Adobe Experience Manager's dispatcher filter can be walked past by appending a selector such as ?.css to a blocked path, exposing CRX Explorer, Package Manager, querybuilder and the OSGi console on live sites. The talk chains that into disk-usage listings, an opensocial proxy SSRF, stale Flash files and a cracked admin hash for code execution.

Record

Researcher

Frans Rosén

Published by

Speaker Deck

Date

13 September 2018

Format

Slides

Topic

Other

In the archive

• Collected in the 2018 research round

Related sources

• SEC-T 0x0B: Frans Rosén - A story of the passive aggressive sysadmin of AEM

Tags

• filter-bypass
• auth-bypass
• ssrf
• info-leak
• rce
• reverse-proxy
• flash
• cve
• bug-bounty
• owasp-a01-2021
• owasp-a05-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Frans Rosén, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.