CVE-2023-28795
📋 TL;DR
This CVE describes an origin validation error in Zscaler Client Connector for Linux that allows attackers to inject code into existing processes. The vulnerability affects Linux systems running Zscaler Client Connector versions before 1.3.1.6, potentially enabling privilege escalation or arbitrary code execution.
💻 Affected Systems
- Zscaler Client Connector
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation leading to complete control of the affected Linux system, data exfiltration, and lateral movement within the network.
Likely Case
Local privilege escalation allowing attackers to gain root access on compromised Linux workstations, potentially leading to credential theft and further network penetration.
If Mitigated
Limited impact with proper network segmentation and endpoint protection, potentially only affecting isolated systems without critical data.
🎯 Exploit Status
Requires local access to the system. No public exploit code has been identified at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1.6
Restart Required: Yes
Instructions:
1. Download Zscaler Client Connector version 1.3.1.6 or later from Zscaler portal. 2. Stop the Zscaler service. 3. Install the updated package using your distribution's package manager. 4. Restart the system or Zscaler service.
🔧 Temporary Workarounds
Remove vulnerable software
linuxUninstall Zscaler Client Connector if not required, though this may impact VPN connectivity.
sudo apt remove zscaler-client-connector
sudo yum remove zscaler-client-connector
sudo zypper remove zscaler-client-connector
🧯 If You Can't Patch
- Implement strict access controls and limit local user privileges on affected systems
- Monitor for suspicious process injection activities using endpoint detection and response (EDR) tools
🔍 How to Verify
Check if Vulnerable:
Check Zscaler Client Connector version using package manager or version commandCheck Version:
zscaler-client-connector --version or check package manager: dpkg -l | grep zscaler-client-connectorVerify Fix Applied:
Verify installed version is 1.3.1.6 or higher and check that Zscaler service is running properly📡 Detection & Monitoring
Log Indicators:
- Unusual process injection events in system logs
- Zscaler service crashes or unexpected restarts
- Privilege escalation attempts in audit logs
Network Indicators:
- Unexpected outbound connections from Zscaler processes
- Anomalous VPN connection patterns
SIEM Query:
source="linux_audit" AND process_name="zscaler*" AND (event_type="EXECVE" OR event_type="PROCTITLE") AND user_change=true🔗 References
- https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
- https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
