Zoom flaw enables users get hacked just by sending a Message

May 31st, 2022 - Written By CyberLabs

Our everyday video conferencing service Zoom was able to resolve as many as 4 security vulnerabilities, which could be used to exploit and comprise other users over chat by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages and execute malicious activity. Tracked from CVE-2022-22784 through CVE-2022-22787, the issues range between 5.9 and 8.1 in severity. Ivan Fratric, from Google Project Zero was credited for discovering these vulnerabilities and reporting all 4 flaws in February 2022.

The list of flaws is as follows:

• CVE-2022-22784 (CVSS score: 8.1) – Improper XML Parsing in Zoom Client for Meetings
• CVE-2022-22785 (CVSS score: 5.9) – Improperly constrained session cookies in Zoom Client for Meetings
• CVE-2022-22786 (CVSS score: 7.5) – Update package downgrade in Zoom Client for Meetings for Windows
• CVE-2022-22787 (CVSS score: 5.9) – Insufficient hostname validation during server switch in Zoom Client for Meetings

Zoom’s chat function is built on top of the XMPP standard, successful exploitation of the problems could enable a threat actor to force a vulnerable client to masquerade a Zoom user, connect malicious server and even download a rogue update, resulting in arbitrary code execution stemming from downgrade attack. Furthermore, the exploit chain can also be weaponized to hijack the software update mechanism and make the user connect to a man-in-the-middle server that serves up an old less secure version of the Zoom client. While the downgrade attack singles out the Windows version of the app, CVE-2022-22784, CVE-2022-22785, and CVE-2022-22787 impact Android, iOS, Linux, macOS, and Windows.

The patches arrive less than a month after Zoom addressed two high-severity flaws (CVE-2022-22782 and CVE-2022-22783) that could lead to local privilege escalation and exposure of memory contents in its on-premise Meeting services. Also fixed was another instance of a downgrade attack (CVE-2022-22781) in Zoom’s macOS app.

Users of the application are recommended to update to the latest version (5.10.0) to mitigate any potential threats arising out of active exploitation of the flaws.

Source

https://thehackernews.com/2022/05/new-zoom-flaws-could-let-attackers-hack.html

https://explore.zoom.us/en/trust/security/security-bulletin/