CVE-2024-45112: Adobe Acrobat Type Confusion RCE Flaw

CVE-2024-45112 Overview

CVE-2024-45112 is a Type Confusion vulnerability affecting Adobe Acrobat and Acrobat Reader that could result in arbitrary code execution in the context of the current user. This issue occurs when a resource is accessed using a type that is not compatible with the actual object type, leading to a logic error that an attacker could exploit. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or installation of malware through malicious PDF documents.

Affected Products

• Adobe Acrobat versions 24.002.21005 and earlier (Classic Track)
• Adobe Acrobat DC versions 24.003.20054 and earlier (Continuous Track)
• Adobe Acrobat Reader versions 20.005.30655, 24.001.30159, and earlier (Classic Track)
• Adobe Acrobat Reader DC (Continuous Track)
• Affected on Microsoft Windows and Apple macOS platforms

Discovery Timeline

• 2024-09-13 - CVE-2024-45112 published to NVD
• 2024-09-19 - Last updated in NVD database

Technical Details for CVE-2024-45112

Vulnerability Analysis

This Type Confusion vulnerability (CWE-843) exists in Adobe Acrobat Reader's handling of object types within PDF documents. Type confusion vulnerabilities occur when code allocates or initializes a resource such as a pointer, object, or variable using one type, but later accesses that resource using a type that is incompatible with the original type. In the context of Adobe Acrobat, this typically involves improper handling of JavaScript objects or internal PDF structures where type validation is insufficient.

The vulnerability requires local access through user interaction—specifically, a victim must be enticed to open a specially crafted malicious PDF document. Once opened, the type confusion condition can be triggered, allowing an attacker to manipulate memory in unexpected ways and ultimately achieve code execution.

Root Cause

The root cause of CVE-2024-45112 lies in insufficient type checking when accessing internal resources within Adobe Acrobat Reader. When a resource is accessed using an incompatible type, the application interprets memory incorrectly, leading to a logic error. This type confusion creates a condition where an attacker can potentially control program flow or corrupt critical data structures.

Type confusion vulnerabilities in PDF readers often occur in JavaScript engine interactions, annotation handling, or font processing routines where complex object hierarchies exist. The lack of proper type validation allows attackers to craft PDF documents that trigger the vulnerable code path with unexpected object types.

Attack Vector

The attack vector for CVE-2024-45112 is local, requiring user interaction. An attacker would typically deliver the exploit through:

1. Email attachments - Sending malicious PDF documents as email attachments with social engineering to encourage opening
2. Malicious websites - Hosting crafted PDF files on compromised or attacker-controlled websites
3. Document sharing platforms - Uploading malicious PDFs to cloud storage or collaboration platforms

When a user opens the malicious PDF in a vulnerable version of Adobe Acrobat or Acrobat Reader, the type confusion is triggered during document processing. The attacker-controlled data causes the application to misinterpret object types, allowing for memory corruption that can be leveraged for arbitrary code execution in the context of the current user.

For detailed technical information about this vulnerability, refer to the Adobe Security Update APSB24-70.

Detection Methods for CVE-2024-45112

Indicators of Compromise

• Unexpected Adobe Acrobat or Acrobat Reader crashes when opening PDF documents, particularly from untrusted sources
• Unusual child processes spawned from AcroRd32.exe or Acrobat.exe processes
• PDF files with obfuscated JavaScript content or unusual embedded objects
• Network connections initiated immediately after opening PDF documents

Detection Strategies

• Deploy endpoint detection rules to monitor for suspicious process behavior from Adobe Acrobat processes, including unexpected child process creation or memory injection attempts
• Implement file scanning solutions to analyze PDF documents for malformed objects or suspicious JavaScript prior to opening
• Configure application whitelisting to restrict code execution from Acrobat Reader processes
• Enable enhanced security settings in Adobe Acrobat including Protected View and sandboxing features

Monitoring Recommendations

• Monitor for anomalous process trees where Adobe Acrobat spawns unexpected executables such as cmd.exe, powershell.exe, or script interpreters
• Implement logging for PDF file access events, particularly for documents originating from external sources
• Configure SIEM alerts for patterns consistent with document-based exploit delivery chains
• Track Adobe Acrobat crash reports and analyze dump files for signs of exploitation attempts

How to Mitigate CVE-2024-45112

Immediate Actions Required

• Update Adobe Acrobat and Acrobat Reader to the latest patched versions immediately via Adobe Creative Cloud or direct download
• Enable Protected View in Adobe Acrobat Reader under Edit > Preferences > Security (Enhanced) > Protected View: All files
• Restrict opening of PDF documents from untrusted sources until patching is complete
• Configure email gateways to scan and sandbox PDF attachments before delivery to end users

Patch Information

Adobe has released security updates addressing CVE-2024-45112 as part of the Adobe Security Bulletin APSB24-70. Organizations should update to the following minimum versions:

• Adobe Acrobat DC (Continuous): Update to version later than 24.003.20054
• Adobe Acrobat 2024 (Classic): Update to version later than 24.001.30159
• Adobe Acrobat 2020 (Classic): Update to version later than 20.005.30655
• Adobe Acrobat Reader: Apply corresponding updates for your track (Continuous or Classic)

Workarounds

• Enable Protected View for all PDF files to run documents in a sandboxed environment, reducing the impact of potential exploits
• Disable JavaScript in Adobe Acrobat Reader under Edit > Preferences > JavaScript > uncheck "Enable Acrobat JavaScript" to mitigate JavaScript-based attack vectors
• Deploy alternative PDF readers in isolated environments for handling untrusted documents until patching is complete
• Implement network segmentation to limit the impact of potential code execution from user workstations

# Windows Registry configuration to disable JavaScript in Acrobat Reader
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enable Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v bProtectedMode /t REG_DWORD /d 1 /f