CVE-2024-42439
📋 TL;DR
This CVE describes an untrusted search path vulnerability in Zoom Workplace Desktop App and Zoom Meeting SDK for macOS. It allows a privileged user with local access to escalate privileges on the system. Only macOS users running vulnerable Zoom versions are affected.
💻 Affected Systems
- Zoom Workplace Desktop App for macOS
- Zoom Meeting SDK for macOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
A local attacker with existing privileges could gain root access to the macOS system, potentially compromising all data and system integrity.
Likely Case
A malicious local user or malware with some privileges could elevate to higher privileges to install persistent backdoors or access protected resources.
If Mitigated
With proper access controls and least privilege principles, the impact is limited to the specific user's context rather than full system compromise.
🎯 Exploit Status
Exploitation requires local access and some existing privileges. The installer's search path manipulation is the attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.0 and later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-24032
Restart Required: Yes
Instructions:
1. Open Zoom application. 2. Click on your profile picture. 3. Select 'Check for Updates'. 4. Install version 6.1.0 or later. 5. Restart the application.
🔧 Temporary Workarounds
Remove vulnerable Zoom versions
macOSUninstall Zoom versions before 6.1.0 from affected macOS systems
sudo rm -rf /Applications/zoom.us.app
sudo rm -rf ~/Library/Application\ Support/zoom.us
Restrict installer permissions
macOSLimit who can run Zoom installer and modify installation directories
sudo chmod 755 /Applications
sudo chown root:wheel /Applications
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges on macOS systems
- Monitor for suspicious privilege escalation attempts and installer-related activities
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in About Zoom dialog or run: defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionStringCheck Version:
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Confirm version is 6.1.0 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusual Zoom installer activity
- Privilege escalation attempts from Zoom processes
- Modifications to Zoom installation directories
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
process_name="zoom" AND (event_type="privilege_escalation" OR parent_process="installer")