Adobe Experience Manager Dispatcher filter bypass via JSON selector
Description
Adobe Experience Manager (AEM) publish instances are usually fronted by the AEM Dispatcher, whose filter rules decide which repository paths and selectors may reach the Sling default GET servlet.
The Dispatcher denies the canonical JSON rendering of a Java Content Repository (JCR) node, but an equivalent request for the same node is allowed. Requests such as /node/.json or a Sling suffix containing dot segments (/node/child.json/../.json) match a permitted filter rule, yet Sling resolves them to the denied node and returns its properties.
Remediation
Base Dispatcher filters on the parsed request parts (/path, /selectors, /extension and /suffix) instead of matching the raw URL, and deny the json extension and Sling suffixes for repository paths that do not need them. Reject request URLs that contain dot segments before they reach the Dispatcher. Review the filter rules against the Adobe Dispatcher security checklist and verify them with requests for both /node.json and /node/.json.