CVE-2022-23202: Adobe Creative Cloud Desktop RCE Flaw

CVE-2022-23202 Overview

Adobe Creative Cloud Desktop version 2.7.0.13 and earlier is affected by an Uncontrolled Search Path Element vulnerability (CWE-427) that could result in arbitrary code execution in the context of the current user. This DLL hijacking vulnerability requires user interaction, as a victim must download a malicious DLL file placed in the same folder as the installer.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or lateral movement within enterprise environments.

Affected Products

• Adobe Creative Cloud Desktop Application version 2.7.0.13 and earlier
• All platforms running vulnerable versions of the Creative Cloud Desktop installer

Discovery Timeline

• 2022-02-16 - CVE-2022-23202 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-23202

Vulnerability Analysis

This vulnerability stems from the Adobe Creative Cloud Desktop installer's failure to properly specify the search path for required DLL libraries. When the installer executes, Windows follows its standard DLL search order, which includes the current working directory. An attacker can exploit this behavior by placing a maliciously crafted DLL file in the same directory where the user downloads and runs the legitimate installer.

The vulnerability requires user interaction and specific conditions to be met—the attacker must successfully deliver a malicious DLL to the same folder as the installer before the victim executes it. This typically involves social engineering tactics such as bundling the malicious DLL with the installer in a compressed archive downloaded from untrusted sources.

Root Cause

The root cause is an Uncontrolled Search Path Element vulnerability (CWE-427) in the Adobe Creative Cloud Desktop installer. The application does not explicitly define or restrict the directories from which DLL files are loaded, allowing Windows to search potentially attacker-controlled locations in the DLL search order. This is a common vulnerability pattern in Windows application installers that do not implement secure DLL loading practices.

Attack Vector

The attack vector is local, requiring the attacker to place a malicious DLL file in the same directory as the Adobe Creative Cloud Desktop installer. The typical attack scenario involves:

1. An attacker creates a malicious DLL with a name matching a legitimate DLL that the installer attempts to load
2. The attacker distributes the malicious DLL alongside the legitimate installer (e.g., in a ZIP archive from an untrusted download source)
3. When the victim extracts and runs the installer from the same directory containing the malicious DLL, Windows loads the attacker's DLL instead of the legitimate one
4. The malicious code executes with the privileges of the current user

The attack requires user interaction and has higher complexity due to the need to deliver the malicious DLL to the correct location before execution.

Detection Methods for CVE-2022-23202

Indicators of Compromise

• Unexpected DLL files present in download directories alongside Adobe installer executables
• DLL files in user-writable directories with names commonly hijacked (e.g., system library names)
• Process execution chains showing the Adobe Creative Cloud installer loading DLLs from non-standard paths
• Anomalous code execution originating from the Creative Cloud Desktop installer process

Detection Strategies

• Monitor for DLL load events where the Adobe Creative Cloud installer loads libraries from user-writable directories such as Downloads, Desktop, or temporary folders
• Implement application whitelisting to prevent unauthorized DLL execution
• Deploy endpoint detection rules that alert on unsigned or untrusted DLLs loaded by Adobe processes
• Use file integrity monitoring on directories where installers are commonly executed

Monitoring Recommendations

• Enable Windows Sysmon logging with DLL load events (Event ID 7) filtered for Adobe installer processes
• Monitor process creation events for the Creative Cloud installer executing from non-standard locations
• Track network downloads of Adobe installer packages followed by execution from the same directory containing additional DLL files
• Implement user behavior analytics to detect unusual installer execution patterns

How to Mitigate CVE-2022-23202

Immediate Actions Required

• Update Adobe Creative Cloud Desktop Application to the latest version that addresses this vulnerability
• Download Adobe installers only from official Adobe sources (adobe.com or Creative Cloud application)
• Before running any installer, verify the download directory contains only the expected installer file
• Run installers from isolated directories that do not contain other DLL files

Patch Information

Adobe has released a security update addressing this vulnerability. Refer to Adobe Security Bulletin APSB22-11 for detailed patch information and updated software versions. Users should update to the latest version of Adobe Creative Cloud Desktop Application through the official Adobe channels.

Workarounds

• Always download Adobe installers directly from official Adobe websites and verify file integrity
• Create a dedicated, clean directory for running installers and ensure no unexpected DLL files are present before execution
• Implement application control policies that restrict DLL loading from user-writable directories
• Use Group Policy to enforce SafeDllSearchMode and restrict DLL loading behavior on Windows systems
• Consider running installers with reduced privileges when possible

# PowerShell: Verify installer directory before execution
# Check for unexpected DLL files in the download directory
Get-ChildItem -Path "$env:USERPROFILE\Downloads" -Filter "*.dll" | Select-Object Name, FullName, LastWriteTime

# Move installer to a clean directory before execution
New-Item -ItemType Directory -Path "$env:TEMP\AdobeInstall" -Force
Move-Item -Path "$env:USERPROFILE\Downloads\CreativeCloudSetup.exe" -Destination "$env:TEMP\AdobeInstall\"