Zoom Patches Remote Hijacking Vulnerabilities

Zoom Patches Remote Hijacking Vulnerabilities

Security researchers had revealed vulnerabilities in various entities of Zoom On-Premise deployments, including On-Premise Meeting Connector, Virtual Room Connector, and Recording Connector. The flaws in the affected versions allow an intruder to command and gain server access with escalated privileges, leading to an application crash or remote control of the system. The company has fixed the issues in the latest versions of the affected applications.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable multi-factor authentication for all of your organizational Zoom accounts.
• Ensure Zoom applications are updated to their latest version or as advised by the vendor.
• Reach out to [email protected] for assistance.

Details

Zoom, a cloud-based video conferencing and web communication platform, addressed three vulnerabilities tracked as CVE-2021-34414, CVE-2021-34415, and CVE-2021-34416. By exploiting these security flaws, an attacker could execute arbitrary commands and gain admin privileges.

• CVE-2021-34414 and CVE-2021-34416 exist in the following implementations:
• Zoom Meeting Connector Controller up to version 4.6.348.20201217
• Zoom Meeting Connector MMR up to version 4.6.348.20201217
• Zoom Recording Connector up to version 3.8.42.20200905
• Zoom Virtual Room Connector up to version 4.4.6620.20201110
• Zoom Virtual Room Connector Load Balancer prior to version 2.5.5495.20210326
• Zoom Meeting Connector up to version 4.6.360.20210325
• Zoom Meeting Connector MMR up to version 4.6.360.20210325

The affected versions of the On-Premise Meeting Connector and Virtual Room Connector fail to validate the input request to update the network configuration, thus allowing the uninvited user to inject arbitrary commands on the on-premise image with the web portal administrator privileges.

The CVE-2021-34415 affects Zoom On-Premise Meeting Connector Controller versions prior to 4.6.358.20210205. Triggering this vulnerability will allow an attacker to exhaust the server resources and lead to application failure.

Conclusion

Lack of input sanitization in the affected components of On-Premise deployments allows external users to intrude into the network. According to security researchers, the malicious actor needs to obtain the admin or sudo credentials to take remote control of the system. The On-Premise users are recommended to deploy multi-factor authentication and keep the system up-to-date.