Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

This XSS vulnerability poses a significant risk to Adobe Connect users. An attacker can inject malicious JavaScript code into vulnerable form fields within the application. When a user accesses a page containing this injected script, their browser will execute it, potentially granting the attacker control over their session. This can lead to unauthorized access to sensitive data, modification of user profiles, or even complete account takeover. The high confidentiality and integrity impact stems from the potential for session hijacking and subsequent malicious actions performed under the victim's identity. The attack surface is broad, encompassing any form field susceptible to script injection.

Organizations and individuals using Adobe Connect for online meetings, webinars, and training sessions are at risk. This includes educational institutions, businesses, and government agencies. Those relying on legacy Adobe Connect deployments or those with inadequate input validation practices are particularly vulnerable.

• adobe / server: Examine Adobe Connect server logs for unusual JavaScript execution patterns or suspicious form submissions.

 grep -i 'script' /var/log/adobe/connect/server.log

• generic web: Use curl to test form fields for XSS vulnerabilities.

curl -X POST -d "<script>alert('XSS')</script>" https://<adobeconnect_server>/<vulnerable_form>

• generic web: Check response headers for Content-Security-Policy (CSP) directives. A strong CSP can mitigate XSS attacks.

1. 2024-12-10Disclosure

   disclosure

1. Reserviert2024-11-27
2. Veröffentlicht2024-12-10
3. Geändert2025-01-14
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-54036 is to upgrade Adobe Connect to version 12.6 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing temporary workarounds. Input validation and sanitization on all user-supplied data within Adobe Connect forms can help reduce the attack surface. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update Adobe Connect's security configuration to ensure best practices are followed. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple script into a form field and verifying that it is not executed.