Zoom patches privilege escalation flaw for macOS users

Communications company Zoom has released a patch to address a flaw that allowed threat actors to control a victim’s operating system on macOS.

The Zoom client has limited permissions as far as access to critical system files is concerned. However, once installed the Zoom auto-update function would run in the background continuously, with superuser privileges.

In normal circumstances, this would simply check for updates from Zoom to install. Upon receiving one, the Zoom updater would run a process to verify that the update bore a cryptographic signature from the company, and was, therefore, a legitimate file to run.

Objective-See founder Patrick Wardle discovered that any file, renamed with Zoom’s cryptographic certificate, would be accepted by the updater as a legitimate Zoom file. As a result, threat actors could use the Zoom updater to run any file as a superuser.

As a result of the flaw, Zoom for macOS had unwittingly become a launchpad for privilege escalation attacks, in which a threat actor with limited access to a victim’s machine uses an exploit to gain elevated privileges that give them greater control. In the case of the Zoom flaw, threat actors could use the updater to delete or amend key system files, with the superuser privilege granting almost unlimited access to the machines of victims.

An update, released on August 13 by Zoom, has now appeared to have fixed the problem. On its security bulletin, the company identified the issue being fixed as “a vulnerability in the auto-update process".

“We released an update to address the newly reported vulnerability for the macOS auto updater in the Zoom Client for Meetings for macOS version 5.11.5 and are evaluating additional security enhancements,” said a Zoom spokesperson, in a statement to IT Pro.

This is not the first flaw found with Zoom's macOS app, with an update released earlier this year addressing an issue in which the microphones of users continued to be accessed by the Zoom client even after a meeting had ended.

Wardle exposed the flaw publicly during his talk ‘"You're M̶u̶t̶e̶d̶ Rooted’ at the Def Con hacking conference on August 12, stating that he had made the company aware of it through the proper channels as far back as December 2021.

In the months that followed, the company was reportedly slow to act. On August 9, a patch designated CVE-2022-28751 was released, but Wardle found that the exploit was still achievable after the patch through an unspecified extra step.

Since the update, Wardle has voiced his approval on Twitter, stating “Mahalos to @Zoom for the (incredibly) quick fix!”. He also detailed the key change that the update brings, namely that the Zoom installer now invokes a function called lchown to modify the update file’s permissions, rather than the updater running at constant superuser privilege.

This article was updated to include a statement from Zoom.