CVE-2024-39820
📋 TL;DR
An uncontrolled search path vulnerability in the Zoom Workplace Desktop App installer for macOS allows authenticated local users to cause denial of service. This affects macOS users running Zoom Workplace Desktop App versions before 6.0.10. Attackers need local access and authentication to exploit this vulnerability.
💻 Affected Systems
- Zoom Workplace Desktop App
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker with local access could disrupt Zoom Workplace functionality, potentially preventing legitimate users from accessing the application or causing system instability.
Likely Case
Local authenticated users could cause temporary service disruption to the Zoom Workplace application, requiring restart or reinstallation.
If Mitigated
With proper access controls limiting local user privileges and timely patching, impact is minimal to non-existent.
🎯 Exploit Status
Exploitation requires authenticated local access. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.10 or later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-24027
Restart Required: Yes
Instructions:
1. Open Zoom Workplace Desktop App. 2. Click on your profile picture. 3. Select 'Check for Updates'. 4. If update to 6.0.10 or later is available, install it. 5. Restart the application after installation.
🔧 Temporary Workarounds
Restrict local user privileges
macOSLimit local user access and privileges on macOS systems to reduce attack surface
🧯 If You Can't Patch
- Implement strict access controls to limit which users have local authentication on affected systems
- Monitor for unusual activity or attempts to manipulate Zoom Workplace installation paths
🔍 How to Verify
Check if Vulnerable:
Check Zoom Workplace version by opening the app, clicking profile picture, and selecting 'About Zoom Workplace'. If version is below 6.0.10, system is vulnerable.Check Version:
Open Terminal and run: /Applications/zoom.us.app/Contents/MacOS/zoom.us --versionVerify Fix Applied:
After updating, verify version is 6.0.10 or higher using the same method. Test Zoom Workplace functionality to ensure no disruption.📡 Detection & Monitoring
Log Indicators:
- Unusual installer activity, failed Zoom Workplace launches, permission errors in system logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Search for Zoom Workplace process failures or installer-related errors in macOS system logs