Adobe CQ 5 Accepts Arbitrary POST Request

Question

i know that Adobe CQ 5 was built on top of Apache Sling (which using JackRabbit). I'm a bit baffled as for why the website will accept arbitrary POST request from outside (unauthenticated user) into Publish Instance through the Dispatcher and then reply with HTTP 200 Content Updated. Should not content update only allowed from Author Instance in this case? Should not such request met with HTTP 403 response instead? - Why is it that even not logged in can get HTTP Response 200?

The response looked like this:

    {
        "changes": [],
        "referer": "http://www.example.com/content/somesite/en.html",
        "path": "/content/somesite/en",
        "location": "/content/somesite/en",
        "parentLocation": "/content/somesite",
        "status.code": 200,
        "status.message": "OK",
        "title": "Content modified /content/somesite/en"
    }

I've set POST Referrer Filter for now to prevent arbitrary POST request 'outside' the website got accepted, however i can still get this response by typing jquery ajax request in the browser console while opening the website. I do wonder if this is bad or something, really new to Adobe CQ.

The JQuery Script for testing it is actually only these:

$.ajax({
    url: 'http://www.example.com/content/fasfas',
    type: 'post',
    data: {},
    headers: {
        Accept: 'application/json',
    },
    dataType: 'json',
    success: function (data) {
        console.info(data);
    }
});

Thanks in advance!

Anonymous and everyone should not have post permissions on arbitrary paths which is the default cause on publisher run mode. Are you sure this is configured correctly? Which version and SP are you using exactly? — Imran Saeed
Just a side-note: Apache Sling is not an implementation of Jackrabbit. Jackrabbit is a JCR implementation and it's used by Apache Sling as a repository. — Daniel Platon
@i.net i'm using Adobe CQ 5.6 10.0.10.167. i do wonder why, since Anonymous did not have any write permission in the user management page.. — Bagus Tesa

rakhi4110 rakhi4110 · Accepted Answer · 2017-06-20T23:49:08

This is an issue of not taking the necessary steps to secure the AEM servers. There is a security checklist provided by Adobe to ensure that AEM installation is secure when deployed. Similar security checklist for the dispatcher is also present.

As for your case, there are few issues which are evident

The filter configuration within the dispatcher doesn't deny POST requests, thereby allowing them to pass through the dispatcher and reach the AEM instance.
The anonymous user in the AEM publisher seems to have more than just READ privileges on the repository thereby allowing him to make changes to the repo using POST requests.
The referrer filter configuration was allowing requests from external systems as well (which you have blocked now).

Adobe CQ 5 Accepts Arbitrary POST Request

2 Answers