CVE-2024-54037: Adobe Connect DOM-Based XSS Vulnerability

CVE-2024-54037 Overview

CVE-2024-54037 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 12.6, 11.4.7, and earlier. An attacker with high privileges can manipulate a DOM element through a crafted URL or user input to inject scripts that execute in the victim's browser context. Successful exploitation enables session takeover, allowing the attacker to compromise the confidentiality and integrity of the affected session. The vulnerability requires user interaction, since the victim must click a malicious link or submit data into a compromised form. The flaw is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows session takeover in the context of an authenticated Adobe Connect user, exposing meeting content and account controls.

Affected Products

Adobe Connect 12.6 and earlier
Adobe Connect 11.4.7 and earlier
All prior 11.x and 12.x releases in the affected branches

Discovery Timeline

2024-12-10 - CVE-2024-54037 published to the National Vulnerability Database (NVD)
2024-12-10 - Adobe publishes the Adobe Connect Security Advisory APSB24-99
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-54037

Vulnerability Analysis

The vulnerability resides in client-side JavaScript that writes attacker-controlled data into the Document Object Model (DOM) without proper neutralization. When Adobe Connect renders a page containing the malicious payload, the injected script executes with the privileges of the authenticated session. Because the attack executes in the browser, it inherits the victim's cookies, tokens, and application state.

The issue is scoped as a DOM-based XSS, meaning the injection occurs entirely within the browser rather than in server-rendered output. The scope change reflects that code executing in the Connect origin can affect resources belonging to other authenticated components. The impact on confidentiality and integrity is high, while availability is not directly affected.

Root Cause

The root cause is missing or insufficient output encoding when client-side scripts insert URL fragments or form input into DOM sinks such as innerHTML, document.write, or event handler attributes. Adobe's advisory does not disclose the specific sink or source, but the CWE-79 mapping and DOM-based classification indicate untrusted data flows into an executable context without sanitization.

Attack Vector

Exploitation requires the attacker to hold a high-privilege account inside the Adobe Connect deployment and to induce a victim to load a crafted URL or submit tainted input. The attacker sends the crafted link over chat, email, or a meeting invitation. Once the victim renders the page, the payload runs and can exfiltrate session tokens, hijack the meeting session, or perform actions as the victim.

No verified proof-of-concept code is publicly available for CVE-2024-54037. Refer to the Adobe Connect Security Advisory APSB24-99 for vendor technical details.

Detection Methods for CVE-2024-54037

Indicators of Compromise

Adobe Connect access logs containing requests with script tags, javascript: URIs, or encoded payloads in query strings or URL fragments
Unexpected outbound requests from browser sessions to attacker-controlled domains shortly after a user opens a Connect link
Session tokens or cookies for Adobe Connect appearing in referer headers or third-party telemetry

Detection Strategies

Inspect web server and reverse proxy logs for anomalous URL parameters targeting Connect endpoints, particularly those containing <script>, onerror=, or base64-encoded JavaScript
Deploy Content Security Policy (CSP) reporting to capture script execution violations originating from Connect pages
Correlate authentication events with high-privilege administrator accounts to identify suspicious link-sharing activity preceding user interaction

Monitoring Recommendations

Alert on Adobe Connect administrator sessions that generate crafted URLs shared to multiple recipients within short time windows
Monitor endpoint browser telemetry for script execution originating from Connect origins that contacts unrecognized external hosts
Track version banners across Connect deployments to identify hosts still running 12.6, 11.4.7, or earlier builds

How to Mitigate CVE-2024-54037

Immediate Actions Required

Upgrade Adobe Connect to the fixed release identified in Adobe Security Bulletin APSB24-99
Audit administrator and high-privilege accounts, rotate credentials, and enforce multi-factor authentication
Instruct users to avoid clicking Connect links received from unexpected sources until patching is complete

Patch Information

Adobe released fixed versions addressing CVE-2024-54037 as documented in APSB24-99. Administrators should apply the vendor-supplied update for their deployment branch (12.x or 11.x) and validate the version banner after upgrade.

Workarounds

Restrict Adobe Connect administrative access to trusted networks using firewall or VPN controls until patches are applied
Enforce a strict Content Security Policy on the Connect origin to limit inline script execution and untrusted script sources
Review and revoke unnecessary administrator privileges to reduce the population of accounts capable of crafting malicious URLs

bash

# Verify installed Adobe Connect build after patching
curl -sk https://<connect-host>/system/version | grep -Ei 'version|build'

# Example CSP header to add at the reverse proxy for defense-in-depth
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'";