Path traversal in Zoom Client application

1) Path traversal

EUVDB-ID: #VU28567

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6110

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote authenticated attacker can send a specially crafted chat message and cause an arbitrary binary planting which could be abused to achieve arbitrary code execution

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zoom Client for Windows: 4.6.10 20033.0407 - 4.6.11 20559.0413

External links

http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1056

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.