Adobe Experience Manager | 跨站脚本 (基于 DOM 的 XSS) (CWE-79)

该 XSS 漏洞允许攻击者通过将恶意脚本注入到网页中来利用该漏洞。一旦脚本成功注入并执行，攻击者可以控制受害者的浏览器，窃取敏感信息，例如 Cookie 和会话令牌。这可能导致攻击者完全接管受害者的会话，并以受害者的身份执行操作。由于需要用户交互（访问恶意页面），攻击者可能需要诱骗用户点击恶意链接或访问被攻击的网站。成功利用该漏洞的潜在影响包括数据泄露、身份盗窃和系统破坏。

Organizations heavily reliant on Adobe Experience Manager for content management and digital asset management are at significant risk. Specifically, deployments with custom components or integrations that handle user-supplied data without proper sanitization are particularly vulnerable. Shared hosting environments where multiple websites share the same Adobe Experience Manager instance should also be considered high-risk, as a compromise of one site could potentially impact others.

• adobe: Examine Experience Manager logs for unusual JavaScript execution patterns or attempts to access sensitive data. • generic web: Use curl/wget to test for reflected input in potentially vulnerable endpoints. Check response headers for unexpected script tags.

curl -X POST -d "<script>alert('XSS')</script>" https://your-aem-site/path/to/vulnerable/endpoint

• generic web: Grep access and error logs for patterns indicative of XSS attempts, such as <script> tags or eval() calls.

grep -i '<script>' /var/log/apache2/access.log

1. 2025-12-10Disclosure

   disclosure

1. 已保留2025-11-05
2. 发布日期2025-12-10
3. 修改日期2026-02-26
4. EPSS 更新日期2026-03-23

缓解此漏洞的首要措施是升级到 Adobe Experience Manager 的修复版本。如果无法立即升级，可以考虑以下临时缓解措施：实施严格的输入验证和输出编码，以防止恶意脚本注入。配置 Web 应用程序防火墙 (WAF) 以检测和阻止 XSS 攻击。审查并更新内容安全策略 (CSP)，以限制浏览器可以加载的资源。监控系统日志和安全警报，以检测可疑活动。