CVE-2024-47423 Overview
Adobe FrameMaker versions 2020.6, 2022.4, and earlier contain an Unrestricted Upload of File with Dangerous Type vulnerability [CWE-434]. The flaw allows an attacker to achieve arbitrary code execution by supplying a malicious file that FrameMaker automatically processes or executes. Successful exploitation requires user interaction, such as opening a crafted document.
Critical Impact
An attacker who convinces a FrameMaker user to open a malicious file gains arbitrary code execution in the context of the current user, compromising confidentiality, integrity, and availability of the host.
Affected Products
- Adobe FrameMaker 2020.6 and earlier
- Adobe FrameMaker 2022.4 and earlier
- Microsoft Windows platforms running the affected FrameMaker builds
Discovery Timeline
- 2024-10-09 - CVE CVE-2024-47423 published to NVD by Adobe (Security Bulletin APSB24-82)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47423
Vulnerability Analysis
The vulnerability is an Unrestricted Upload of File with Dangerous Type issue [CWE-434] in Adobe FrameMaker. FrameMaker accepts externally supplied files without validating their type or safely constraining how they are subsequently processed. When a user opens or imports the crafted file, FrameMaker routes it into a code path capable of executing native operations, giving attacker-controlled content the ability to run code.
The attack is local and requires user interaction, but authentication is not required. Because FrameMaker runs in the user's security context, successful exploitation inherits that user's privileges and file system access on the Windows host.
Root Cause
The root cause is missing or insufficient validation of file type, extension, and content before FrameMaker hands the file to an internal processor. FrameMaker relies on trust boundaries that assume input files are benign, so a dangerous file type reaches components not designed to safely handle attacker-controlled data.
Attack Vector
An attacker delivers a crafted file to a FrameMaker user through email, a shared drive, or a web download. The user opens or imports the file into FrameMaker on Windows. FrameMaker processes the malicious content and executes attacker-supplied code with the user's privileges. Refer to the Adobe Security Bulletin APSB24-82 for vendor-supplied technical detail.
No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at the time of publication.
Detection Methods for CVE-2024-47423
Indicators of Compromise
- Unexpected child processes spawned by FrameMaker.exe, particularly command interpreters such as cmd.exe, powershell.exe, or wscript.exe.
- FrameMaker writing executable content (.exe, .dll, .js, .hta) into user-writable paths such as %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
- Inbound FrameMaker document files (.fm, .book, .mif) delivered from external email or untrusted web sources.
- Outbound network connections initiated by FrameMaker.exe to previously unseen hosts shortly after a document open event.
Detection Strategies
- Hunt for process-tree anomalies where FrameMaker.exe is the parent of scripting or shell binaries.
- Alert on FrameMaker executing files from user download or temp directories.
- Correlate document open events with subsequent file-write and network activity from the FrameMaker process.
Monitoring Recommendations
- Enable Windows process creation logging (Event ID 4688) with command-line capture on hosts running FrameMaker.
- Forward endpoint telemetry, email gateway logs, and web proxy logs to a central data lake for cross-source correlation.
- Track FrameMaker version inventory to identify unpatched hosts still exposed to CVE-2024-47423.
How to Mitigate CVE-2024-47423
Immediate Actions Required
- Upgrade Adobe FrameMaker to the fixed release identified in Adobe Security Bulletin APSB24-82.
- Inventory Windows endpoints for FrameMaker 2020.6, 2022.4, and earlier, and prioritize patching for authors handling external documents.
- Instruct users not to open FrameMaker files received from untrusted or unverified sources until patching is complete.
Patch Information
Adobe released fixed builds for FrameMaker on 2024-10-08 as part of APSB24-82. Apply the vendor updates that supersede FrameMaker 2020.6 and 2022.4. See the Adobe Security Bulletin APSB24-82 for exact fixed version numbers and download links.
Workarounds
- Restrict FrameMaker file associations so untrusted documents do not open automatically on double-click.
- Block inbound FrameMaker file types at the email gateway and web proxy where authoring is not required.
- Run FrameMaker under a standard, non-administrative user account to limit blast radius of successful exploitation.
- Apply application allowlisting to prevent FrameMaker from spawning script interpreters or unsigned executables.
# Configuration example: audit FrameMaker installations on Windows endpoints
Get-CimInstance -ClassName Win32_Product |
Where-Object { $_.Name -like "*FrameMaker*" } |
Select-Object Name, Version, InstallDate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
