In style video conferencing service Zoom has resolved as many as 4 safety vulnerabilities, which might be exploited to compromise one other person over chat by sending specifically crafted Extensible Messaging and Presence Protocol (XMPP) messages and execute malicious code.
Tracked from CVE-2022-22784 via CVE-2022-22787, the problems vary between 5.9 and eight.1 in severity. Ivan Fratric of Google Venture Zero has been credited with discovering and reporting all of the 4 flaws in February 2022.
The checklist of bugs is as follows –
- CVE-2022-22784 (CVSS rating: 8.1) – Improper XML Parsing in Zoom Shopper for Conferences
- CVE-2022-22785 (CVSS rating: 5.9) – Improperly constrained session cookies in Zoom Shopper for Conferences
- CVE-2022-22786 (CVSS rating: 7.5) – Replace bundle downgrade in Zoom Shopper for Conferences for Home windows
- CVE-2022-22787 (CVSS rating: 5.9) – Inadequate hostname validation throughout server change in Zoom Shopper for Conferences
With Zoom’s chat performance constructed on high of the XMPP customary, profitable exploitation of the problems may allow an attacker to drive a weak shopper to masquerade a Zoom person, connect with a malicious server, and even obtain a rogue replace, leading to arbitrary code execution stemming from a downgrade assault.
Fratric dubbed the zero-click assault sequence as a case of “XMPP Stanza Smuggling,” including “one person may be capable of spoof messages as if coming from one other person” and that “an attacker can ship management messages which might be accepted as if coming from the server.”
At its core, the problems reap the benefits of parsing inconsistencies between XML parsers in Zoom’s shopper and server to “smuggle” arbitrary XMPP stanzas — a primary unit of communication in XMPP — to the sufferer shopper.
Particularly, the exploit chain will be weaponized to hijack the software program replace mechanism and make the shopper connect with a man-in-the-middle server that serves up an previous, much less safe model of the Zoom shopper.
Whereas the downgrade assault singles out the Home windows model of the app, CVE-2022-22784, CVE-2022-22785, and CVE-2022-22787 affect Android, iOS, Linux, macOS, and Home windows.
The patches arrive lower than a month after Zoom addressed two high-severity flaws (CVE-2022-22782 and CVE-2022-22783) that would result in native privilege escalation and publicity of reminiscence contents in its on-premise Assembly providers. Additionally fastened was one other occasion of a downgrade assault (CVE-2022-22781) in Zoom’s macOS app.
Customers of the applying are really helpful to replace to the most recent model (5.10.0) to mitigate any potential threats arising out of lively exploitation of the failings.
