CVE-2024-45422
📋 TL;DR
An improper input validation vulnerability in Zoom Apps before version 6.2.0 allows unauthenticated attackers to cause denial of service via network access. This affects Zoom Apps users running vulnerable versions, potentially disrupting application functionality.
💻 Affected Systems
- Zoom Apps
📦 What is this software?
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Zoom Apps functionality, rendering the application unusable until restarted or patched.
Likely Case
Temporary service degradation or application crashes affecting user productivity and meeting functionality.
If Mitigated
Minimal impact with proper network segmentation and updated software.
🎯 Exploit Status
The vulnerability requires network access but no authentication, making exploitation straightforward for attackers with network connectivity to vulnerable systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.0 and later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-24044
Restart Required: Yes
Instructions:
1. Open Zoom Apps. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. Install version 6.2.0 or later. 5. Restart the application.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Zoom Apps to trusted networks only
Application Firewall Rules
allImplement firewall rules to limit incoming connections to Zoom Apps
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach Zoom Apps instances
- Monitor for unusual traffic patterns or repeated connection attempts to Zoom Apps
🔍 How to Verify
Check if Vulnerable:
Check Zoom Apps version in Settings > About. If version is below 6.2.0, the system is vulnerable.Check Version:
On Windows: zoom.exe --version. On macOS/Linux: open Zoom Apps and check About section.Verify Fix Applied:
Confirm Zoom Apps version is 6.2.0 or higher in Settings > About.📡 Detection & Monitoring
Log Indicators:
- Multiple failed connection attempts
- Application crash logs
- Unusual network traffic patterns
Network Indicators:
- High volume of malformed packets to Zoom Apps ports
- Unusual traffic spikes to Zoom Apps
SIEM Query:
source="zoom_apps" AND (event_type="crash" OR connection_count > threshold)