https://www.bugcrowd.com/blog/remote-code-execution-rce-101

RCE em AEM por bypass do Dispatcher.
O pesquisador acessou o GroovyConsole adicionando extensão .gif ao caminho (/etc/groovyconsole/jcr.html/aa3.gif#).
Comandos diretos foram bloqueados, então desenvolveu script alternativo para exfiltrar variáveis de ambiente e listar diretórios

Bugcrowd

Remote code execution (RCE) 101 | @Bugcrowd

I like to think of RCE not just as a bug but as an impact. Why? Because there are numerous ways—literally 1001—to achieve RCE. The initial foothold for an RCE attack can vary significantly, ranging from unrestricted file uploads and command injection to SQL…