CVE-2024-30302
📋 TL;DR
CVE-2024-30302 is a use-after-free vulnerability in Adobe Acrobat Reader that could allow an attacker to read sensitive memory contents and bypass ASLR protections. This affects users of Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier. Exploitation requires the victim to open a malicious PDF file.
💻 Affected Systems
- Adobe Acrobat Reader DC
- Adobe Acrobat Reader
📦 What is this software?
Acrobat by Adobe
⚠️ Risk & Real-World Impact
Worst Case
An attacker could bypass ASLR and combine this with other vulnerabilities to achieve remote code execution, potentially compromising the entire system.
Likely Case
Information disclosure allowing attackers to read sensitive memory contents, which could be used to facilitate more sophisticated attacks.
If Mitigated
Limited to information disclosure only, with no direct code execution if proper memory protections are in place.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious PDF). The vulnerability bypasses ASLR but additional vulnerabilities would be needed for full exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.005.30554 or 23.008.20476 and later
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to install available updates. 4. Restart the application.
🔧 Temporary Workarounds
Disable JavaScript in PDFs
allPrevents JavaScript execution in PDF files which may be used in exploitation chains
Edit > Preferences > JavaScript > Uncheck 'Enable Acrobat JavaScript'
Use Protected View
allOpen untrusted PDFs in Protected View mode to limit potential damage
File > Properties > Security > Enable Protected View for untrusted files
🧯 If You Can't Patch
- Restrict PDF file opening to trusted sources only
- Implement application whitelisting to prevent unauthorized PDF readers
🔍 How to Verify
Check if Vulnerable:
Check Help > About Adobe Acrobat Reader DC. If version is 20.005.30539 or earlier, or 23.008.20470 or earlier, you are vulnerable.Check Version:
On Windows: wmic product where "name like 'Adobe Acrobat Reader%'" get versionVerify Fix Applied:
Verify version is 20.005.30554 or later, or 23.008.20476 or later after applying updates.📡 Detection & Monitoring
Log Indicators:
- Application crashes in Acrobat Reader
- Unusual memory access patterns in system logs
Network Indicators:
- PDF downloads from suspicious sources
- Unexpected outbound connections after PDF opening
SIEM Query:
source="*acrobat*" AND (event_type="crash" OR event_type="exception")