CVE-2024-34116: Adobe Creative Cloud Auth Bypass Flaw

CVE-2024-34116 Overview

CVE-2024-34116 affects Adobe Creative Cloud Desktop versions 6.1.0.587 and earlier. The vulnerability stems from an Uncontrolled Search Path Element weakness [CWE-427] that enables a security feature bypass. An attacker can load and execute malicious libraries through the flawed search path resolution. Successful exploitation leads to arbitrary file deletion on the affected system. Exploitation requires local access and user interaction. Adobe published the fix in security advisory APSB24-44 on June 13, 2024.

Critical Impact
Attackers can plant malicious libraries that Creative Cloud Desktop loads at runtime, resulting in arbitrary file deletion and integrity loss on the affected host.

Affected Products

Adobe Creative Cloud Desktop Application version 6.1.0.587
Adobe Creative Cloud Desktop Application versions earlier than 6.1.0.587
Windows installations of the Creative Cloud Desktop client

Discovery Timeline

2024-06-13 - Adobe releases security patch in advisory APSB24-44
2024-06-13 - CVE-2024-34116 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34116

Vulnerability Analysis

Creative Cloud Desktop resolves library dependencies using an uncontrolled search path. The application searches directories in a predictable order when locating shared libraries at runtime. An attacker who places a malicious library in an early-priority search location causes the application to load attacker-controlled code. The loaded library inherits the privileges of the Creative Cloud Desktop process. Adobe classifies the resulting outcome as arbitrary file deletion combined with a security feature bypass.

Root Cause

The root cause is improper control over the library search path [CWE-427]. Creative Cloud Desktop does not enforce absolute paths or validated directories when loading dependent modules. The loader accepts libraries from writable or user-influenced locations before trusted system directories. This design allows planted files to satisfy dependency resolution ahead of legitimate libraries.

Attack Vector

Exploitation requires local access and user interaction. An attacker first places a crafted malicious library in a location referenced by the application's search path. The victim then launches Creative Cloud Desktop or triggers an operation that loads the affected module. The application executes the attacker's code within its own security context. The delivered payload performs arbitrary file deletion, which can remove security artifacts, break integrity checks, or disable protective components. No verified public exploit code is currently available for this issue.

Detection Methods for CVE-2024-34116

Indicators of Compromise

Unexpected DLL or shared library files present in directories adjacent to the Creative Cloud Desktop installation path
Creative Cloud Desktop processes loading libraries from user-writable paths such as %TEMP%, %APPDATA%, or the current working directory
Unexplained deletion of files following execution of Creative Cloud.exe or its child processes
Modules loaded with signatures that do not match Adobe-signed binaries

Detection Strategies

Monitor image-load telemetry for Creative Cloud Desktop processes and alert on unsigned or non-Adobe modules
Correlate Creative Cloud.exe execution with subsequent file deletion events in protected directories
Baseline expected library load paths for the Creative Cloud Desktop client and flag deviations

Monitoring Recommendations

Enable Sysmon Event ID 7 (ImageLoad) filtering scoped to Creative Cloud Desktop binaries
Track file creation events for DLL files written to directories that Creative Cloud Desktop traverses
Review Windows Defender Application Control or AppLocker logs for blocked module load attempts near Adobe process activity

How to Mitigate CVE-2024-34116

Immediate Actions Required

Upgrade Adobe Creative Cloud Desktop to a version later than 6.1.0.587 as directed in advisory APSB24-44
Inventory endpoints running Creative Cloud Desktop and prioritize hosts where users hold local administrative rights
Restrict write access to directories referenced in the Creative Cloud Desktop library search path

Patch Information

Adobe published the fixed release alongside advisory Adobe Security Advisory APSB24-44 on June 13, 2024. Administrators should deploy the vendor-supplied update through the Creative Cloud Desktop auto-update mechanism or via managed software distribution. Verify the installed version reports higher than 6.1.0.587 after deployment.

Workarounds

Enforce application control policies that permit only Adobe-signed libraries to load into Creative Cloud Desktop processes
Remove write permissions from non-administrative users on the Creative Cloud Desktop installation directory and its parent path
Instruct users to avoid launching Creative Cloud Desktop from removable media or shared network locations until patching completes

bash

# Configuration example: verify installed Creative Cloud Desktop version on Windows
powershell -Command "Get-ItemProperty 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like 'Adobe Creative Cloud' } | Select-Object DisplayName, DisplayVersion"