Loading vulnerability…
CVE-2025-54253 is a critical remote code execution vulnerability in Adobe Experience Manager Forms on Java Enterprise Edition (JEE) affecting version 6.5.23.0 and earlier. The issue stems from a misconfiguration in the administrative interface that leaves Apache Struts developer mode enabled and exposes a debug servlet without authentication. As a result, attacker-controlled OGNL expressions supplied to the debug functionality are evaluated by the Struts framework, enabling unauthenticated command execution on the underlying server. The vulnerability requires no user interaction, can be exploited remotely with low attack complexity, and has changed scope because successful exploitation can impact resources beyond the vulnerable application component.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
Repository contains a single Python tool (aempwn.py) plus README and GPLv3 license. The tool is a multi-target network scanner aimed at Adobe Experience Manager (AEM) Forms endpoints for CVE-2025-54253 and CVE-2025-54254. It normalizes targets to HTTPS by default, then POSTs XML to a fixed list of likely AEM Forms submission endpoints. Capabilities include: (1) a safe behavior probe using a per-run canary token to detect XML reflection/unsafe parsing surface; (2) in-band XXE probes attempting to read local files (/etc/hostname, /etc/passwd, C:\\Windows\\win.ini) and AWS metadata via 169.254.169.254; (3) an OOB XXE mode that sends a parameter-entity payload referencing {oob_url}/evil.dtd (requires attacker-hosted DTD and monitoring); and (4) an RCE escalation mode that sends an external entity reference to an attacker-supplied LDAP/JNDI URL (e.g., ldap://host:1389/#Exploit), intended to trigger Java class loading/execution when combined with external LDAP/HTTP infrastructure (as described in README). Results are scored and printed; confirmed hits are appended to an output file (code default: aempwn-results.txt). The code uses threading for mass scanning and disables TLS verification.
This repository provides a simulated proof-of-concept (PoC) for CVE-2025-54253, an OGNL injection vulnerability in Adobe AEM. The structure includes a vulnerable Flask server (server/server/app.py) that mimics the behavior of a misconfigured AEM endpoint, a PoC script (poc/cve-2025-54253-poc.py) that sends OGNL payloads as system commands to the server, and supporting files such as logs and documentation. The exploit demonstrates remote command execution by sending crafted requests to the '/adminui/debug' endpoint with the 'debug' parameter containing an OGNL expression. The server executes the command and returns the output, simulating the impact of the vulnerability. The repository is strictly for educational and defensive research purposes, with clear warnings against use outside of isolated lab environments. No real-world exploitation code is provided for production systems. The main attack vector is network-based, targeting a web endpoint. Fingerprintable endpoints include the simulated HTTP URLs and the log file used for tracking payloads and responses.
This repository provides a proof-of-concept (PoC) exploit for CVE-2025-54253, a critical OGNL injection vulnerability in Adobe AEM Forms on JEE (versions <= 6.5.23.0). The vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands via the /adminui/debug endpoint by injecting OGNL expressions. The repository contains: - A Python PoC script (poc/cve-2025-54253-poc.py) that sends crafted GET requests to the vulnerable endpoint, executing commands such as 'whoami', 'id', 'uname -a', and 'ls -la'. - A simulated vulnerable Flask server (server/server/app.py) that mimics the behavior of the vulnerable endpoint for local testing and demonstration purposes. This server executes received commands if the 'debug' parameter starts with 'OGNL:'. - Logs (logs/exploit.log) showing example exploitation attempts and command execution. - Documentation (README.md) with technical details, exploitation steps, mitigation advice, and references. The main exploit capability is unauthenticated remote code execution via network-accessible HTTP requests to the /adminui/debug endpoint. The repository is structured for both demonstration and testing, with clear separation between the PoC, server simulation, and documentation. No fake or detection-only scripts are present; the code is a functional exploit PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
85 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability in Adobe AEM Forms on JEE caused by exposed Apache Struts devMode debug servlet functionality that evaluates attacker-controlled OGNL expressions.
A remote code execution vulnerability affecting Adobe AEM Forms related to Apache Struts 'DevMode' functionality, enabling potential code execution on vulnerable instances.
A deserialization vulnerability in Adobe Experience Manager, potentially leading to remote code execution. Actively exploited and in CISA's KEV catalog.
A misconfiguration vulnerability in Adobe Experience Manager Forms on Java EE that is being actively exploited in the wild.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.