CVE-2023-28603
📋 TL;DR
The Zoom VDI client installer prior to version 5.14.0 contains an improper access control vulnerability that allows a malicious user to delete local files without proper permissions. This affects organizations using Zoom's Virtual Desktop Infrastructure client on vulnerable versions.
💻 Affected Systems
- Zoom VDI Client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could delete critical system files, leading to data loss, system instability, or denial of service.
Likely Case
Malicious insider or compromised account could delete user files, configuration files, or application data.
If Mitigated
With proper user privilege separation and file permissions, impact is limited to files accessible to the user's account.
🎯 Exploit Status
Requires local access to the system. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.14.0 and later
Vendor Advisory: https://explore.zoom.us/en/trust/security/security-bulletin/
Restart Required: Yes
Instructions:
1. Download Zoom VDI client version 5.14.0 or later from official Zoom website. 2. Uninstall previous version. 3. Install new version. 4. Restart the system.
🔧 Temporary Workarounds
Restrict local user privileges
allLimit user accounts to standard user privileges to reduce impact scope
Implement file system auditing
allMonitor for unauthorized file deletion attempts
🧯 If You Can't Patch
- Remove Zoom VDI client from systems where it's not essential
- Implement strict access controls and monitor for suspicious file deletion activity
🔍 How to Verify
Check if Vulnerable:
Check Zoom VDI client version in application settings or via 'zoom --version' commandCheck Version:
zoom --versionVerify Fix Applied:
Confirm version is 5.14.0 or higher and test file deletion permissions📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events
- Zoom VDI client process accessing system files
Network Indicators:
- N/A - local vulnerability
SIEM Query:
EventID=4663 (Windows File System Audit) with process name containing 'zoom'