Members of Cisco’s Talos threat intelligence and research group have identified two vulnerabilities in the Zoom client application that can allow a remote attacker to write files to the targeted user’s system and possibly achieve arbitrary code execution.
The vulnerabilities, tracked as CVE-2020-6109 and CVE-2020-6110 and both rated high severity, have been described as path traversal issues that could ultimately lead to arbitrary code execution. One impacts Zoom 4.6.10, 4.6.11 and likely earlier versions, and one of them only affects 4.6.10 and earlier. Newer versions of the video conferencing app patch the flaws.
CVE-2020-6109 is related to the way Zoom processes GIF image files. The vulnerability allows an attacker to send a specially crafted message to a user or group and it would result in a file being written to any directory to which the current user can write files.
According to Talos, the file would have a .gif extension but its content could be executable code or a script, which could aid the attacker in the exploitation of other vulnerabilities.
Exploitation of CVE-2020-6110 also involves sending a specially crafted message to a user or a group. Successful exploitation can result in a self-extracting ZIP file being written to certain folders, which could be useful for exploiting other flaws. However, Talos noted in its advisory, that an attacker can also achieve code execution, but this requires some user interaction.
In an attack scenario described by the company, the attacker sends a malicious ZIP file to the target with a name and extension that is unlikely to raise suspicion (e.g. interesting_image.jpeg). The user downloads the file, but they will not be able to open it directly due to the fact that it’s not a real image and it doesn’t have an archive extension for it to be opened by an archiving tool.
The attacker then sends the victim a code snippet via Zoom with the same file ID and the same details in the obj tag. When Zoom sees that the file has already been downloaded, it will unzip the previously downloaded file to a location picked by the attacker — this can be nearly any folder. If an attacker uses this technique to overwrite files that are at some point executed by the system, they will achieve execution of their own code.
Zoom has promised to make improvements when it comes to patching vulnerabilities reported by external parties and the company is working on revamping its bug bounty program.
Zoom is also working on implementing end-to-end encryption to offer better security and privacy, but the feature will only be available to paying customers and schools. The company revealed that free users, which are more likely to abuse its platform, will not get end-to-end encryption to allow law enforcement to conduct investigations.
Related: Flaw Could Have Allowed Hackers to Identify All Zoom Users in a Company
Related: Zoom Vulnerabilities Expose Users to Spying, Other Attacks
Related: Vulnerability Allowed Attackers to Join Zoom Meetings
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
Latest News
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- City of Dallas Details Ransomware Attack Impact, Costs
- In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
