CVE-2024-34123: Adobe Premiere Pro RCE Vulnerability

CVE-2024-34123 Overview

CVE-2024-34123 is an Untrusted Search Path vulnerability affecting Adobe Premiere Pro that could lead to arbitrary code execution. The vulnerability exists in Premiere Pro versions 23.6.5, 24.4.1, and earlier, where an attacker could exploit the application's search path mechanism by inserting a malicious file that the application might execute instead of a legitimate file.

This type of vulnerability occurs when the application uses a search path to locate executables or libraries. An attacker with local access could place a malicious DLL or executable in a directory that Premiere Pro searches before the legitimate system directories, causing the application to load and execute the attacker's code with the privileges of the user running the application.

Critical Impact

Successful exploitation could allow an attacker to achieve arbitrary code execution on the victim's system, potentially leading to complete system compromise, data theft, or lateral movement within an organization's network.

Affected Products

• Adobe Premiere Pro versions 23.6.5 and earlier
• Adobe Premiere Pro versions 24.4.1 and earlier
• Affected on both Microsoft Windows and Apple macOS platforms

Discovery Timeline

• July 9, 2024 - CVE-2024-34123 published to NVD
• December 3, 2024 - Last updated in NVD database

Technical Details for CVE-2024-34123

Vulnerability Analysis

This vulnerability falls under CWE-426 (Untrusted Search Path), which describes a weakness where an application searches for critical resources in locations that could be under the control of untrusted parties. In the context of Adobe Premiere Pro, the application's executable search path can be manipulated to include directories where an attacker has write access.

The attack requires local access to the system and user interaction to trigger the vulnerable code path. When Premiere Pro attempts to load a library or execute a subprocess, it searches through a series of directories in a specific order. If an attacker can place a malicious file with the expected name in a directory that appears earlier in the search path than the legitimate file's location, the malicious file will be loaded instead.

The high attack complexity rating reflects the need for precise conditions to be met: the attacker must identify which files are loaded via the vulnerable search path, gain write access to a directory in that path, and ensure the victim triggers the code path that loads the vulnerable resource.

Root Cause

The root cause of CVE-2024-34123 lies in Adobe Premiere Pro's handling of search paths when locating and loading executables or libraries. The application does not adequately validate or restrict the directories it searches, allowing potentially untrusted locations to be included in the search path. This design flaw enables DLL hijacking or binary planting attacks where malicious files can be substituted for legitimate ones.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have some level of access to the target system. The exploitation scenario typically involves:

1. The attacker identifies a library or executable that Premiere Pro loads via an untrusted search path
2. The attacker places a malicious file with the same name in a directory that Premiere Pro searches before the legitimate location
3. The victim launches Adobe Premiere Pro or performs an action that triggers the loading of the targeted resource
4. Premiere Pro loads the malicious file instead of the legitimate one, executing the attacker's code

This vulnerability requires user interaction—the victim must launch or interact with Premiere Pro in a way that triggers the vulnerable code path. The attack complexity is considered high because the attacker must carefully craft the exploit conditions and may need specific knowledge of the target system's configuration.

Detection Methods for CVE-2024-34123

Indicators of Compromise

• Unexpected DLL or executable files in Adobe Premiere Pro installation directories or working directories
• Premiere Pro loading libraries from unusual or non-standard locations
• Suspicious process creation events with Premiere Pro as the parent process
• Unexpected network connections or file system modifications following Premiere Pro execution

Detection Strategies

• Monitor file creation events in directories associated with Adobe Premiere Pro installation and working paths
• Implement application whitelisting to detect unauthorized libraries being loaded by Premiere Pro
• Use endpoint detection and response (EDR) solutions to monitor for DLL hijacking indicators
• Configure Windows Security Event logging to capture module load events (Event ID 7) for Premiere Pro processes

Monitoring Recommendations

• Enable detailed process auditing to track library loads and process creation chains
• Monitor for modifications to PATH environment variables and application-specific search paths
• Implement file integrity monitoring on Adobe Premiere Pro installation directories
• Review audit logs for privilege escalation attempts following Premiere Pro execution

How to Mitigate CVE-2024-34123

Immediate Actions Required

• Update Adobe Premiere Pro to the latest patched version as specified in Adobe Security Advisory APSB24-46
• Audit systems for potentially malicious DLLs or executables in Premiere Pro-related directories
• Restrict write permissions to directories in the application's search path
• Implement application control policies to prevent unauthorized code execution

Patch Information

Adobe has released security updates to address this vulnerability. Organizations should apply the patches detailed in Adobe Security Advisory APSB24-46. The advisory provides specific version information and download links for the patched releases of Adobe Premiere Pro.

For enterprise deployments, administrators should use Adobe's enterprise deployment tools to distribute the updated versions across managed endpoints.

Workarounds

• Restrict user permissions to prevent writing to directories in Premiere Pro's search path
• Configure Windows SafeDllSearchMode to prioritize system directories in the search order
• Remove write access to the application's installation directory for non-administrative users
• Consider using application sandboxing or virtualization to limit the impact of potential exploitation

# Windows: Enable SafeDllSearchMode (if not already enabled)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f

# Verify Premiere Pro installation directory permissions (PowerShell)
Get-Acl "C:\Program Files\Adobe\Adobe Premiere Pro 2024" | Format-List