A critical vulnerability has been discovered in the Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310. This vulnerability, identified as CVE-2022-22783, exposes process memory fragments to connected clients. As a result, a passive attacker could potentially observe and access sensitive information, leading to unauthorized access to meetings, user data, and other critical infrastructure.

Exploit Details

This vulnerability is an information disclosure issue that arises due to memory management error in Zoom's On-Premise Meeting Connector. When a client connects to a Zoom meeting using the vulnerable connector, certain process memory fragments containing sensitive information are inadvertently exposed to the connected clients, allowing a passive attacker to observe the content.

To demonstrate this, let's consider the following simple code snippet that represents a vulnerable scenario with exposed memory fragments:

// Process request from client
ControllerResponse processRequest(ClientRequest request) {
   // Perform required actions for the request
   ...
   // Fetch sensitive information from memory
   SensitiveInfo info = fetchSensitiveInformation();
   // Inadvertently expose memory fragment containing sensitive information to request
   exposeToClientRequest(request, info);
}

While the above example is simplified, it illustrates the potential risk involved. An attacker who can passively intercept the communication between a Zoom client and a vulnerable Zoom On-Premise Meeting Connector could potentially gain unauthorized access to sensitive information.

Original References

For more information on the CVE-2022-22783 vulnerability, related findings, and reported issues, please refer to the following original references:

1. CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2022-22783

Mitigation

Zoom has released a patch to address this vulnerability in both affected components. To mitigate the risk associated with CVE-2022-22783, it is strongly recommended to update your Zoom On-Premise Meeting Connector Controller and On-Premise Meeting Connector MMR to the latest patched version.

Log in to the Zoom Web Portal and navigate to the "Meeting Connector" page.

2. Under "Meeting Connector Software," you will find the download links for the latest patched version of Controller and MMR.

Additionally, as a security best practice, it is advised to always maintain updated software, enable encryption for your Zoom meetings, and implement robust access controls to safeguard your organization's sensitive information.

Conclusion

CVE-2022-22783 is a serious vulnerability that could expose sensitive information to unauthorized users in specific Zoom On-Premise Meeting Connector setups. It is crucial for organizations using these vulnerable components to update their software as soon as possible to prevent potential exploitation and protect their meetings, user data, and critical infrastructure. Always practice safe security measures and stay informed on the latest updates and advisories to ensure your online communication remains secure.

Timeline

Published on: 04/28/2022 15:15:00 UTC
Last modified on: 05/09/2022 18:39:00 UTC