Insufficient server-side validation in AEM profile update
In Adobe Experience Manager (AEM), the Author CMS allows profile updates through the Touch UI without enforcing robust server-side validation. The issue stems from AEM’s default permissive validation model, which doesn’t enforce strict checks on profile fields. To resolve the issue, implement server-side validation using Sling PostProcessor or custom servlet logic.
Description description
Environment
Adobe Experience Manager (AEM), v6.5
Issue/Symptoms
-
Insufficient server-side validation was identified during a vulnerability assessment and penetration testing (VAPT). Symptoms include:
- The AEM Author CMS accepts invalid email input during profile updates via the Touch UI.
- Client-side validation exists, but server-side checks are missing, allowing modified requests with invalid data to update profile fields.
-
The vulnerability was identified during a Vulnerability Assessment and Penetration Testing (VAPT) exercise.
Steps to reproduce:
- Log in to the AEM backend and navigate to the edit profile page.
- Observe that there is client-side validation for the email field.
- Enter a valid email address and intercept the request using Burp Suite while saving the changes.
- Modify the value of the email parameter to an invalid value such as fake.
- Forward the modified request and observe that the profile is saved successfully without a valid email.
Resolution resolution
AEM’s input validation model is intentionally flexible by default. The repository adopts a permissive approach, and minimal restrictions are enforced on most fields, including the email attribute. Out-of-the-box, there’s generally no strict validation on profile data fields—it’s up to the application or consumer to enforce content integrity where needed.
To introduce robust server-side input validation (for example, for email fields), consider the following options:
- Implement the Sling PostProcessor interface to validate input managed by the Sling Post Servlet during standard content updates in AEM Author.
- Add validation logic in dedicated servlets for cases where profile updates are handled outside the Sling Post Servlet.
This ensures all required fields are validated according to your application’s needs while maintaining flexibility for other use cases.
Related reading
Sling Servlet in the AEM Forms Tutorials