CVE-2024-23462
📋 TL;DR
An improper validation vulnerability in Zscaler Client Connector on macOS allows attackers to cause denial of service by crashing the client binary, which removes VPN and security functionality. This affects macOS users running Zscaler Client Connector versions before 3.4.
💻 Affected Systems
- Zscaler Client Connector
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of VPN connectivity and security protections for affected macOS endpoints, potentially exposing them to network-based attacks.
Likely Case
Temporary disruption of Zscaler Client Connector service requiring manual restart or system reboot to restore functionality.
If Mitigated
Minimal impact with proper monitoring and rapid incident response procedures in place.
🎯 Exploit Status
Requires ability to trigger the integrity check validation failure on the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4
Vendor Advisory: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4
Restart Required: Yes
Instructions:
1. Download Zscaler Client Connector 3.4 or later from official Zscaler sources. 2. Install the update following standard macOS application installation procedures. 3. Restart the application or system as prompted.
🔧 Temporary Workarounds
Restart Service Workaround
macosManually restart Zscaler Client Connector service if it crashes
sudo launchctl stop com.zscaler.ZscalerService
sudo launchctl start com.zscaler.ZscalerService
🧯 If You Can't Patch
- Implement network monitoring to detect when Zscaler Client Connector stops functioning
- Establish procedures for rapid manual restart of the service when crashes occur
🔍 How to Verify
Check if Vulnerable:
Check Zscaler Client Connector version in application settings or via 'defaults read /Applications/Zscaler/Zscaler.app/Contents/Info.plist CFBundleShortVersionString'Check Version:
defaults read /Applications/Zscaler/Zscaler.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Confirm version is 3.4 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Zscaler Client Connector crash logs in Console.app
- Unexpected termination of Zscaler processes
Network Indicators:
- Sudden loss of VPN connectivity from macOS endpoints
- Zscaler tunnel disconnection events
SIEM Query:
source="macos" AND (process="Zscaler" OR process="ZscalerService") AND event="crash" OR event="terminated"