CVE-2024-54045: Adobe Connect Reflected XSS Vulnerability

CVE-2024-54045 Overview

CVE-2024-54045 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 12.6, 11.4.7, and earlier. An unauthenticated attacker can craft a malicious URL that, when visited by a victim, executes attacker-controlled JavaScript in the context of the victim's browser session. Exploitation requires user interaction, typically through social engineering such as phishing. The flaw is tracked under CWE-79 and stems from insufficient sanitization of user-controlled input reflected into server responses. Adobe published advisory APSB24-99 addressing this issue.

Critical Impact
Successful exploitation allows execution of arbitrary JavaScript in the victim's browser, enabling session token theft, credential capture, and unauthorized actions within the Adobe Connect application.

Affected Products

Adobe Connect version 12.6
Adobe Connect version 11.4.7
Adobe Connect earlier versions

Discovery Timeline

2024-12-10 - CVE-2024-54045 published to the National Vulnerability Database
2024-12-10 - Adobe publishes security advisory APSB24-99
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54045

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in Adobe Connect, a web conferencing platform. Reflected XSS occurs when an application echoes untrusted input from an HTTP request back into a response without proper encoding or sanitization. An attacker crafts a URL containing malicious JavaScript payload parameters. When the victim clicks the link, the vulnerable page reflects the payload into the rendered HTML, and the browser executes it under the origin of the Adobe Connect application.

Because the attack executes in the victim's authenticated session context, adversaries can read session cookies, exfiltrate meeting content, hijack accounts, or pivot to further attacks against the collaboration environment. The scope is changed, indicating impact beyond the vulnerable component.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. A vulnerable page reflects request parameters into the HTTP response without contextual output encoding, allowing script content to be interpreted as executable code by the browser.

Attack Vector

The attack vector is network-based and requires user interaction. An unauthenticated attacker crafts a URL referencing the vulnerable Adobe Connect page with an embedded JavaScript payload. The attacker delivers the URL through phishing email, chat, or a compromised third-party site. When the victim clicks the link, malicious script executes in the browser context of the Adobe Connect origin.

No verified public exploit code is available. The vulnerability mechanism is described in the Adobe Security Advisory APSB24-99.

Detection Methods for CVE-2024-54045

Indicators of Compromise

Inbound HTTP requests to Adobe Connect endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= payloads in query parameters.
Web server access logs showing unusually long or obfuscated query strings targeting Adobe Connect meeting or content URLs.
Browser reports of unexpected redirects, popups, or credential prompts originating from the Adobe Connect domain.
Outbound requests from user browsers to unfamiliar domains immediately after loading an Adobe Connect URL.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters for XSS payload signatures targeting Adobe Connect paths.
Correlate email gateway telemetry with proxy logs to identify users who followed suspicious Adobe Connect URLs delivered via phishing.
Enable Content Security Policy (CSP) reporting in browsers to capture violation reports indicating injected script attempts.

Monitoring Recommendations

Monitor Adobe Connect server logs for HTTP requests containing suspicious script fragments or unusual encoding patterns.
Alert on anomalous session activity such as unexpected administrative actions, session token reuse from new IP addresses, or bulk data access.
Track user-reported phishing messages referencing Adobe Connect URLs and pivot on the referenced hostnames.

How to Mitigate CVE-2024-54045

Immediate Actions Required

Apply the security updates listed in Adobe advisory APSB24-99 to all Adobe Connect deployments, prioritizing internet-facing instances.
Inventory all Adobe Connect servers to confirm running versions and identify hosts still on 12.6, 11.4.7, or earlier.
Notify end users to be cautious of unsolicited Adobe Connect meeting or content links, particularly those received via email or chat.

Patch Information

Adobe released fixed versions of Adobe Connect addressing CVE-2024-54045. Refer to the Adobe Security Advisory APSB24-99 for the specific patched builds and download instructions. Apply patches according to Adobe's guidance and validate the update on non-production instances before broad rollout.

Workarounds

If patching is delayed, restrict access to Adobe Connect using network segmentation, VPN, or IP allowlisting to reduce exposure.
Deploy a web application firewall in front of Adobe Connect and enable XSS signature rules that block reflected script payloads in URL parameters.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit exploit impact.
Train users to identify suspicious links and report phishing attempts referencing Adobe Connect resources.

bash

# Example WAF rule (ModSecurity) blocking common reflected XSS payloads on Adobe Connect endpoints
SecRule REQUEST_URI "@rx /(admin|content|meeting)/" \
    "chain,phase:2,deny,status:403,id:1054045,\
    msg:'Potential CVE-2024-54045 reflected XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"