Zoom Windows client UNC path flaw
A vulnerability in Zoom's Windows client chat feature lets attackers steal credentials or run arbitrary executables via malicious hyperlinks.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
IPA (Information-technology Promotion Agency, Japan) issued an alert regarding a vulnerability in the Windows client of Zoom, the video conferencing application. The flaw stems from improper handling of UNC (Universal Naming Convention) paths within the chat feature, allowing a malicious hyperlink crafted by an attacker to trigger credential theft or execution of arbitrary executable files when clicked by a victim.
The advisory warns that damage could expand if left unaddressed and urges users to apply vendor-provided patches promptly. IPA directs users to check version-specific remediation status via the linked vendor resources. No active exploitation is described in the article; this is a preventive advisory.
Mentioned in this report
Detection guidance
Zoom Client Spawning Process from UNC Path (Chat Link Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Zoom.exe launching a child process whose executable path or command line references a UNC (\\server\share) path, consistent with exploitation of the Zoom UNC path handling flaw when a user clicks a malicious chat link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zoom Client Child Process Executed From UNC Path
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \Zoom.exe
unc_path:
CommandLine|contains: \\\\
condition: selection and unc_path
falsepositives:
- Legitimate use of Zoom to open files or links stored on approved internal network
shares
- Corporate deployment scripts that reference UNC paths for shared resources
level: high
tags:
- attack.t1204.001
- attack.t1187
id: 4b58b340-be8f-525f-9969-f19306114488
status: experimental
author: Vorant
Zoom Process Initiating Outbound SMB Connection (Forced Authentication via UNC Link)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Zoom.exe initiating an outbound SMB (port 445) connection, which can occur when a malicious UNC hyperlink in Zoom chat is clicked, forcing the victim's client to authenticate to an attacker-controlled host and leak NTLM credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zoom Client Outbound SMB Connection to Remote Host
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \Zoom.exe
DestinationPort: 445
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Zoom transferring or opening files hosted on legitimate internal file shares
- VPN-connected clients whose internal ranges are not captured by the private-range
filter
level: medium
tags:
- attack.t1187
- attack.t1204.001
id: 786b2c3d-4c09-5388-8e3a-6ce1e64128ee
status: experimental
author: Vorant
Explorer or Command Shell Launched With UNC Path Argument Following Zoom Activity
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects explorer.exe or a command interpreter being invoked with a UNC path argument shortly after user interaction with Zoom, indicative of a victim clicking a malicious chat hyperlink that triggers remote file/executable access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Explorer Or Shell Invoked With UNC Path Argument Near Zoom Activity
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith:
- \explorer.exe
- \cmd.exe
- \powershell.exe
selection_unc:
CommandLine|contains: \\\\
parent_zoom:
ParentImage|endswith: \Zoom.exe
condition: selection_image and selection_unc and parent_zoom
falsepositives:
- Users legitimately opening shared drive links pasted into Zoom chat by colleagues
- IT support workflows that share UNC paths through chat for troubleshooting
level: medium
tags:
- attack.t1204.001
- attack.t1187
id: 361ec5c2-d47d-508b-868b-238973ae4678
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200403.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs