Responding to recursive directory listing requests in Adobe Experience Manager as a Cloud Service
Adobe Experience Manager as a Cloud Service (AEMaaCS) customers can’t generate a server-level recursive directory listing (RDL) because Adobe manages the underlying operating system, filesystem, and service infrastructure. Security requirements for file and directory exposure must instead be addressed through architectural documentation and validation of customer-controlled configurations. To resolve the issue, provide the relevant Adobe resources as compensating evidence, review application and Dispatcher configurations, validate externally accessible files and directories, and escalate specific evidence requirements to Adobe Support when necessary.
Description description
Environment
Adobe Experience Manager as a Cloud Service (AEMaaCS), all versions
Issue/Symptoms
Organizations undergoing security assessments may receive requests for a complete recursive directory listing (RDL) of the web server. This typically involves providing an inventory of all files and directories under the web (document) root, often generated by operating system commands such as ls -laR or find on UNIX/Linux systems.
Root cause
In AEM as a Cloud Service, Adobe fully manages the underlying operating system, filesystem, and service infrastructure. Customers don’t have OS-level access to the underlying servers and can’t generate a server-level RDL themselves. Security requirements for file and directory exposure must be addressed using architectural documentation and by validating customer-controlled configurations.
Resolution resolution
Follow the steps below to resolve the issue:
-
Inform the security assessor that AEM as a Cloud Service is a managed platform and that customers don’t have OS-level access to generate a server-level recursive directory listing (RDL).
-
Provide the following Adobe resources as compensating evidence for audit or assessment purposes:
- Introduction to the Architecture of Adobe Experience Manager as a Cloud Service
- AEM as a Cloud Service Security Overview
- Adobe Trust Center
- Dispatcher Security Checklist
-
Review the deployed application code, content, and Dispatcher configuration to ensure that temporary, backup, or unintended files aren’t included or exposed.
-
Use external scanning tools to verify that no directory listings or sensitive files are accessible through public URLs.
-
Ensure that Dispatcher rules are configured to block access to unwanted file types and paths.
-
If the assessment requires a formal statement, explain that:
- AEM as a Cloud Service is a managed service, and customers can’t generate a server-level RDL.
- Adobe provides architectural and security documentation as compensating evidence.
- Customers are responsible for securing application-level and Dispatcher configurations.
-
If the assessor requires further evidence or a specific compensating control, collect the exact control text and required evidence format, and escalate the request to Adobe Support.
-
Verify that no directory listings or sensitive files are accessible through public URLs and that security scans return the expected results, such as 404 or 403 responses for blocked paths.