VORANT. Threat Intelligence Research Create a free account

Zoom Windows client UNC injection flaw

Published Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Zoom Windows client chat feature vulnerable to UNC path injection, enabling credential theft and arbitrary code execution via malicious hyperlinks.

Sourceipa.go.jp — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

Japan's IPA (Information-Technology Promotion Agency) has issued a security alert regarding a vulnerability in the Zoom Windows client's chat functionality. The flaw relates to improper handling of UNC (Universal Naming Convention) paths. Attackers can exploit this vulnerability by crafting malicious hyperlinks that, when clicked by victims in Zoom chat, can steal Windows authentication credentials or trigger execution of arbitrary executable files.

The vulnerability leverages the Windows SMB protocol's automatic authentication behavior when UNC paths are accessed. When a user clicks a specially crafted UNC link in Zoom chat, the Windows client may automatically send NTLM credentials to an attacker-controlled server, or execute files from remote shares. IPA warns that this vulnerability poses an expanding threat and urges immediate remediation.

The vendor has released patches to address this issue. Organizations using Zoom Windows clients should apply the available security updates immediately. Users should also exercise caution when clicking links in Zoom chats, particularly those from untrusted or unknown participants.

Related reporting

Detection guidance

Zoom Chat UNC Path Execution via Explorer/Shell Handler

ATT&CK T1204.002 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects Zoom.exe spawning explorer.exe or rundll32.exe with a command line referencing a UNC path, consistent with a malicious hyperlink in Zoom chat triggering execution or forced SMB access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Zoom Chat UNC Path Execution via Explorer/Shell Handler
id: 9cec9e5e-895f-5d12-ad93-38f9460f2033
status: experimental
description: Detects Zoom.exe launching a shell handler process (explorer.exe, rundll32.exe,
  cmd.exe) with a UNC path argument, consistent with exploitation of the Zoom Windows
  client UNC link handling flaw.
references:
- IPA advisory on Zoom Windows client UNC injection flaw
author: Vorant
tags:
- attack.t1204.002
- attack.t1187
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \\Zoom.exe
    Image|endswith:
    - \\explorer.exe
    - \\rundll32.exe
    - \\cmd.exe
    CommandLine|contains: \\\\
  filter:
    CommandLine|contains:
    - C:\\
    - D:\\
  condition: selection and not filter
falsepositives:
- Legitimate corporate use of UNC paths to internal file shares referenced in chat
  links
- Users pasting internal network share paths for collaboration purposes
level: high

Outbound SMB Connection Initiated by Zoom Client Process

ATT&CK T1187 · status experimental · needs windows network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects Zoom.exe or its helper processes initiating outbound SMB (port 445/139) connections, which may indicate automatic NTLM authentication triggered by a malicious UNC link clicked in Zoom chat. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound SMB Connection Initiated by Zoom Client Process
id: 5deecf23-1fcb-58bb-a72f-ddb4d27376e7
status: experimental
description: Detects the Zoom Windows client process initiating an outbound SMB connection,
  consistent with forced NTLM authentication triggered by clicking a crafted UNC hyperlink
  in Zoom chat.
references:
- IPA advisory on Zoom Windows client UNC injection flaw
author: Vorant
tags:
- attack.t1187
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \\Zoom.exe
    - \\CptHost.exe
    - \\ZoomUCWinExt.exe
    DestinationPort:
    - 445
    - 139
    Initiated: 'true'
  filter:
    DestinationIp|startswith:
    - '10.'
    - 192.168.
    - 172.16.
  condition: selection and not filter
falsepositives:
- Legitimate corporate SMB shares reachable via internal IP ranges not covered by
  the filter
- Split-tunnel VPN configurations exposing internal file share addressing as external
  ranges
level: medium

Process Execution from Remote UNC Share Spawned by Zoom Client

ATT&CK T1204.002 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a child process image path residing on a remote UNC share and spawned directly by the Zoom Windows client, indicating execution of a remote executable via a malicious chat link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Execution from Remote UNC Share Spawned by Zoom Client
id: 536727a9-f062-5da2-956d-9348ecaed7de
status: experimental
description: Detects Zoom.exe spawning a child process whose image path is a UNC network
  path, consistent with arbitrary executable execution triggered from a crafted Zoom
  chat link.
references:
- IPA advisory on Zoom Windows client UNC injection flaw
author: Vorant
tags:
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \\Zoom.exe
    Image|startswith: \\\\
  condition: selection
falsepositives:
- Organizations that deploy applications directly from mapped network shares as standard
  practice
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200403.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs