CVE-2024-54051: Adobe Connect Open Redirect Vulnerability

CVE-2024-54051 Overview

Adobe Connect versions 12.6, 11.4.7 and earlier contain a URL Redirection to Untrusted Site vulnerability, commonly known as an Open Redirect [CWE-601]. An attacker can craft a link that appears to point to a trusted Adobe Connect domain but redirects victims to an attacker-controlled site. Exploitation requires user interaction, typically clicking a malicious link delivered via email, chat, or a compromised web page. The flaw supports phishing and credential-harvesting campaigns by abusing the trust users place in Adobe Connect URLs.

Critical Impact
Attackers can weaponize legitimate-looking Adobe Connect URLs to redirect users to phishing or malware-hosting sites, bypassing user awareness training that relies on domain inspection.

Affected Products

Adobe Connect 12.6 and earlier
Adobe Connect 11.4.7 and earlier
Adobe Connect on-premises and hosted deployments running vulnerable versions

Discovery Timeline

2024-12-10 - CVE-2024-54051 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54051

Vulnerability Analysis

CVE-2024-54051 is an Open Redirect vulnerability [CWE-601] in Adobe Connect, a web conferencing platform. The application accepts a user-controllable URL parameter and issues an HTTP redirect to that destination without properly validating whether the target belongs to an allow-listed domain. Because the initial request originates from a legitimate Adobe Connect URL, victims and email security filters often treat the link as trusted. Exploitation requires user interaction and does not by itself grant code execution or data access on the Adobe Connect server. The primary risk is downstream: phishing pages that harvest Connect credentials, drive-by downloads, or browser-based exploit delivery.

Root Cause

The vulnerability stems from missing or insufficient validation of a redirect target parameter within Adobe Connect request handlers. The application trusts user-supplied input to determine the redirect destination and does not restrict it to a whitelist of internal hosts or relative paths. Under [CWE-601], any redirection endpoint that echoes untrusted input into a Location response header without domain validation is exploitable.

Attack Vector

An attacker constructs a URL pointing to the vulnerable Adobe Connect endpoint with the redirect parameter set to an attacker-controlled domain. The link is delivered through phishing email, instant messaging, social media, or a watering-hole page. When the victim clicks the link, Adobe Connect returns a redirect response that sends the browser to the malicious destination. The victim's browser address bar transitions from the trusted Adobe Connect domain to the attacker site, often too quickly to notice. No verified public proof-of-concept or exploit code is available for this issue. Refer to the Adobe Security Bulletin APSB24-99 for vendor-supplied technical details.

Detection Methods for CVE-2024-54051

Indicators of Compromise

Web server or proxy logs showing Adobe Connect URLs containing suspicious redirect parameters that resolve to external, non-Adobe domains.
Outbound HTTP 302 responses from Adobe Connect endpoints with Location headers pointing to unfamiliar or newly registered domains.
User reports of Adobe Connect links that unexpectedly land on login pages mimicking Adobe or corporate SSO portals.

Detection Strategies

Parse Adobe Connect access logs for query strings containing URL-encoded external hostnames in redirect-related parameters.
Deploy web application firewall (WAF) rules that inspect redirect parameter values against an allow-list of trusted domains.
Correlate email security telemetry with proxy logs to identify inbound messages containing Adobe Connect URLs followed by outbound traffic to low-reputation destinations.

Monitoring Recommendations

Alert on redirect responses from Adobe Connect where the Location header points to a domain outside the organization's approved list.
Monitor DNS and proxy logs for spikes in traffic to newly registered domains referenced from Adobe Connect sessions.
Track user click-through patterns on Adobe Connect links reported by mail gateways or user-submitted phishing reports.

How to Mitigate CVE-2024-54051

Immediate Actions Required

Upgrade Adobe Connect to the fixed versions identified in Adobe Security Bulletin APSB24-99.
Inventory all internal and external references to Adobe Connect URLs and validate that redirect endpoints are not embedded in bookmarks or automation.
Notify users and help-desk staff to scrutinize Adobe Connect links, particularly those received via unsolicited email.

Patch Information

Adobe released fixes for CVE-2024-54051 as part of security bulletin APSB24-99. Administrators should apply the vendor-supplied updates to Adobe Connect 12.6 and 11.4.7 or earlier. Full remediation details and download instructions are available in the Adobe Security Bulletin APSB24-99.

Workarounds

Deploy WAF or reverse-proxy rules that strip or validate redirect parameters on Adobe Connect endpoints until patching is complete.
Configure email security gateways to rewrite and sandbox Adobe Connect URLs, flagging redirects that exit trusted domains.
Enforce user awareness training that highlights redirect-based phishing patterns and encourages reporting of suspicious Connect links.

bash

# Example WAF rule concept: block Adobe Connect redirect parameters pointing off-domain
# ModSecurity-style pseudocode
SecRule REQUEST_URI "@rx /connect/.*[?&](url|redirect|next|return)=" \
    "chain,deny,status:403,msg:'Blocked off-domain Adobe Connect redirect'"
  SecRule ARGS:url|ARGS:redirect|ARGS:next|ARGS:return \
    "!@rx ^(https?://)?([a-z0-9.-]+\.)?example\.com(/|$)"