CVE-2024-24697
📋 TL;DR
This vulnerability allows an authenticated user on a Windows system to escalate privileges by exploiting an untrusted search path in Zoom's 32-bit client. Attackers could gain higher system permissions than intended. Only users running 32-bit Zoom clients on Windows are affected.
💻 Affected Systems
- Zoom Client for Windows
📦 What is this software?
Rooms by Zoom
Zoom by Zoom
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM-level privileges, enabling complete system compromise, data theft, persistence mechanisms, and lateral movement.
Likely Case
Authenticated user elevates to administrator privileges, allowing installation of malware, configuration changes, or access to protected resources.
If Mitigated
With proper user privilege separation and endpoint protection, impact limited to user-level activities with no privilege escalation.
🎯 Exploit Status
Requires authenticated local access. Exploitation likely involves DLL planting or search order hijacking techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.17.11 or later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/ZSB-24004/
Restart Required: Yes
Instructions:
1. Open Zoom client. 2. Click profile picture > Check for Updates. 3. Install update to version 5.17.11 or later. 4. Restart Zoom client. 5. Verify version in Settings > About.
🔧 Temporary Workarounds
Upgrade to 64-bit Zoom
windowsMigrate to 64-bit Zoom client which is not affected by this vulnerability
Download 64-bit installer from https://zoom.us/download
Restrict DLL loading
windowsApply DLL search order hardening via Group Policy or registry
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zoom.exe" /v "CWDIllegalInDllSearch" /t REG_DWORD /d 0xffffffff /f
🧯 If You Can't Patch
- Implement least privilege: Ensure users run with standard user accounts, not administrator privileges
- Deploy application control policies to prevent unauthorized DLL loading and execution
🔍 How to Verify
Check if Vulnerable:
Check Zoom version: Open Zoom > Settings > About. If version is below 5.17.11 and architecture is 32-bit, system is vulnerable.Check Version:
wmic product where "name like '%Zoom%'" get versionVerify Fix Applied:
Confirm Zoom version is 5.17.11 or later in Settings > About, and verify no unexpected DLLs load from user-writable directories.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs: Process creation from unusual locations, DLL loading from user directories by Zoom.exe
- Zoom logs showing version below 5.17.11
Network Indicators:
- Not applicable - local privilege escalation
SIEM Query:
EventID=4688 AND NewProcessName="*Zoom.exe" AND (ProcessCommandLine="*" OR ParentProcessName="*") | where Version < "5.17.11"