Critical Vulnerabilities in Adobe Campaign Classic

The NCSC-NL has identified three critical vulnerabilities in Adobe Campaign Classic, carrying a maximum CVSS score of 10.0. These flaws include Server-Side Request Forgery (SSRF) and OS Command Injection, both of which can be triggered without user interaction by an unauthenticated attacker. The exploitation of these vulnerabilities allows for remote code execution and unauthorized access to the underlying server infrastructure. Given the high potential for system compromise, organizations running Adobe Campaign Classic are advised to apply the latest security patches provided by Adobe as a matter of urgency. The vulnerabilities are identified as CVE-2024-41865, CVE-2024-41866, and CVE-2024-41867.

Impact

Successful exploitation of these vulnerabilities results in unauthorized remote access to the host server running Adobe Campaign Classic. This allows attackers to execute arbitrary commands, exfiltrate sensitive data, or pivot into the internal network. The NCSC-NL assesses the potential damage to organizations as 'high'.

Recommendation

• Immediately apply the security updates provided by Adobe to remediate CVE-2024-41865, CVE-2024-41866, and CVE-2024-41867.
• Review web server logs for suspicious requests involving anomalous URI parameters or outbound connections originating from the Adobe Campaign Classic application server that may indicate exploitation attempts.