CVE-2025-54249

published 2025-09-09

CVE-2025-54249: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security…

Priority P1 79 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
adobe	adobe_experience_manager	<= 6.5.23.0	—
adobe	experience_manager	<= 6.5.23.0	—
adobe	experience_manager	<= 2025.8.0	—
adobe	experience_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /services/accesstoken/verify;x='.pdf/x'

url /services/accesstoken/verify;x='.ico/x'

url /services/accesstoken/verify;x='.html/x'

url /services/accesstoken/verify;x='.css/x'

url /services/accesstoken/verify;x='x/graphql/execute/json/x'

url /graphql/execute.json/..%2F../services/accesstoken/verify

path /services/accesstoken/verify

command auth_url=https%3A%2F%2F{{interactsh-url}}

• → The SSRF is triggered via a POST to /services/accesstoken/verify with path-suffix bypass variants (semicolon-extension tricks and path traversal) to evade AEM dispatcher/filter rules. Monitor for POST requests to this endpoint with unusual path suffixes.
• → The exploit posts an attacker-controlled URL in the `auth_url` body parameter to force the AEM server to make an outbound HTTP request (OOB/OAST detection). Alert on outbound HTTP from AEM servers originating from this endpoint.
• → Path traversal variant using URL-encoded double-dot segments to reach the vulnerable endpoint through the GraphQL path: /graphql/execute.json/..%2F../services/accesstoken/verify
• → Requests carrying the User-Agent 'hopgoblin/1.0' are associated with automated exploitation of this CVE. Use this as a high-confidence detection signal in WAF/proxy logs.
• → A successful exploitation response returns HTTP 200 with an HTML body. Correlate status_code==200 and body containing '<html' on requests to the /services/accesstoken/verify path variants.
• → FOFA/asset-discovery fingerprint for exposed AEM instances: search for body containing '/libs/granite/core/content/login.html'.

• · The vulnerability affects Adobe Experience Manager versions 6.5.23.0 and earlier; the SSRF bypass is only exploitable on unpatched instances up to and including this version. ↗
• · The exploit uses semicolon-based path suffix tricks (e.g., ;x='.pdf/x') to bypass AEM dispatcher filter rules that allowlist static-extension paths. Detection rules must account for these suffix variants and not rely solely on exact path matching.
• · Out-of-band (OOB/OAST) detection via an interactsh callback is required to confirm exploitation, as the server-side request is made to an external URL supplied in the auth_url parameter.

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vulncheck 6.5 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918