Log in Request a demo

Security News

Adobe Acrobat Reader DC RCE Vulnerability: Exploit Code Released

Recently patched critical RCE vulnerability in the Adobe Acrobat Reader DC software has been identified with the publication of PoC exploitation code.

Updated 3 Min Read

CVE-2023-21608 is a use-after-free flaw in Adobe Acrobat Reader that can let an attacker run code as the current user if that user opens a specially crafted PDF. NVD rates it 7.8 (High). Adobe fixed it in bulletin APSB23-01, and a researcher group later published proof-of-concept exploit code. Update Adobe Acrobat Reader to a fixed version.

A patched high-severity (CVSS 7.8) Remote Code Execution (RCE) vulnerability in the Adobe Acrobat Reader DC software has been identified with the publication of proof-of-concept (PoC) exploitation code.

How does the Adobe Acrobat Reader flaw work?

The security vulnerability, coded as CVE-2023-21608, arises from a Use-After-Free error that could cause arbitrary code execution in a current user session. The threat actor could exploit this security vulnerability by convincing users to open a specially crafted document, allowing them to use the user’s privileges to execute arbitrary code on the system or cause the application to crash.

Did Adobe Release a Security Bulletin for Adobe Acrobat Reader?

Adobe patched the vulnerability through a security bulletin, but after the update was released, Hacksysteam security research announced the publication of PoC code targeting the exploitation of CVE-2023-21608 vulnerability. To avoid being targeted by attacks that could be carried out using the vulnerability and exploitation code, it is recommended that users who are using vulnerable Adobe Acrobat Reader DC versions upgrade to the current version where the vulnerability has been fixed.

Which Acrobat Reader versions are affected?

The National Vulnerability Database lists Adobe Acrobat Reader versions 22.003.20282 and earlier, 22.003.20281 and earlier, and 20.005.30418 and earlier as affected. The score is 7.8 with a local attack vector, and exploitation needs user interaction: the victim has to open a malicious file. The NVD record also shows that CISA added the flaw to its Known Exploited Vulnerabilities catalog on 10 October 2023, with a due date of 31 October 2023 for federal agencies, so the issue moved from a published proof of concept to confirmed exploitation.

Why does a PDF flaw matter to companies?

PDF files arrive by email, chat and download links every day, and most staff open them without a second thought. A use-after-free bug in the reader runs code with the rights of the logged-in user, so on a laptop with admin rights it can lead to full control of the machine. The common attack path is a phishing email with a crafted attachment, which is why patching the reader and filtering attachments work together.

Acrobat Reader patch checklist
  • Find installed Acrobat and Reader versionsUse your software inventory, not user reports.
  • Install the version fixed in Adobe bulletin APSB23-01 or laterNewer builds also include the fix.
  • Turn on automatic updates for the readerManual patching falls behind quickly.
  • Scan mail attachments and open unknown PDFs in a sandboxCrafted PDFs are the delivery route.
  • Limit admin rights on user laptopsThe code runs with the user rights.

Frequently Asked Questions.

What is CVE-2023-21608?

It is a use-after-free vulnerability in Adobe Acrobat and Acrobat Reader. NVD says it could result in arbitrary code execution in the context of the current user.

Which Adobe Acrobat Reader versions are affected?

NVD lists Acrobat Reader DC (Continuous) 22.003.20282 and earlier, and Acrobat Reader (Classic 2020) 20.005.30418 and earlier. Update to the fixed version named in Adobe bulletin APSB23-01.

How severe is CVE-2023-21608?

The NVD record lists a CVSS 3.1 base score of 7.8 (High), with a local attack vector and required user interaction.

Is CVE-2023-21608 exploited in the wild?

CISA added it to the Known Exploited Vulnerabilities catalog on October 10, 2023, with a due date of October 31, 2023 for federal agencies.

How do I protect against it?

Upgrade Adobe Acrobat Reader to a version where the flaw is fixed, and avoid opening PDF files from unknown senders.

Sources

  1. 1 NVD record for CVE-2023-21608
  2. 2 CISA Known Exploited Vulnerabilities catalog
  3. 3 HackSys Team proof-of-concept repository for CVE-2023-21608
Share

In This Article

TechniquesPhishing (T1566): ATT&CK Technique TermsProof-of-concept exploit TermsRemote code execution (RCE) TermsThreat actor TermsKnown Exploited Vulnerabilities (KEV) catalog TermsSandbox

Where To Next.

All Security News Articles
In plain words · Glossary term Proof-of-concept exploit A proof-of-concept exploit is code that shows a vulnerability can be exploited. Open → Keep reading · Article Reddit Suffered a Security Breach Resulting in Unauthorized Access to Internal Systems Reddit suffered a security breach resulting in unauthorized access to its internal systems, sensitive documents, and system source code by threat actors. Open → Keep reading · Article Code Signing Certificates for GitHub Desktop and Atom Apps Suffered Unauthorized Access GitHub discovered that a series of repositories used in the planning and development of GitHub Desktop and Atom were accessed by unknown threat actors. Open →

Knowledge HubVulnerabilities