Zoom RCE bug Haunts ! Patch it

A bunch of bugs identified in Zoom that can be exploited to compromise another user over chat by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages.

Below are the vulnerabilities addressed

• CVE-2022-22784 – Improper XML Parsing in Zoom Client for Meetings
• CVE-2022-22785 – Improperly constrained session cookies in Zoom Client for Meetings
• CVE-2022-22786 – Update package downgrade in Zoom Client for Meetings for Windows
• CVE-2022-22787 – Insufficient hostname validation during server switch in Zoom Client for Meetings

The most severe flaw addressed by Zoom is tracked as CVE-2022-22784 with a CVSS score: 8.1, it is an Improper XML Parsing in Zoom Client for Meetings.

A threat actor can exploit the flaw to break out of the current XMPP message context and create a new message context to have the receiving user’s client perform a variety of actions.

Chaining the above vulnerabilities, an attacker can trick a vulnerable client into connecting to a rogue server, potentially leading to arbitrary code execution due to an update package downgrade in Zoom Client for Windows that could allow the installation of a less secure version.

This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.Zoom users are recommended to install the latest version (5.10.0) that addresses the above vulnerabilities.