# Zoom Windows client UNC injection flaw Published: 2020-04-02 · Severity: high Canonical: https://vorant.io/reports/964bc3b7-e317-4518-945d-da3490915852/zoom-windows-client-unc-injection-flaw > Zoom Windows client chat feature vulnerable to UNC path injection, enabling credential theft and arbitrary code execution via malicious hyperlinks. Japan's IPA (Information-Technology Promotion Agency) has issued a security alert regarding a vulnerability in the Zoom Windows client's chat functionality. The flaw relates to improper handling of UNC (Universal Naming Convention) paths. Attackers can exploit this vulnerability by crafting malicious hyperlinks that, when clicked by victims in Zoom chat, can steal Windows authentication credentials or trigger execution of arbitrary executable files. The vulnerability leverages the Windows SMB protocol's automatic authentication behavior when UNC paths are accessed. When a user clicks a specially crafted UNC link in Zoom chat, the Windows client may automatically send NTLM credentials to an attacker-controlled server, or execute files from remote shares. IPA warns that this vulnerability poses an expanding threat and urges immediate remediation. The vendor has released patches to address this issue. Organizations using Zoom Windows clients should apply the available security updates immediately. Users should also exercise caution when clicking links in Zoom chats, particularly those from untrusted or unknown participants. ## Detection guidance (public sample) ### Zoom Chat UNC Path Execution via Explorer/Shell Handler ATT&CK: T1204.002 Detects Zoom.exe spawning explorer.exe or rundll32.exe with a command line referencing a UNC path, consistent with a malicious hyperlink in Zoom chat triggering execution or forced SMB access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Zoom Chat UNC Path Execution via Explorer/Shell Handler id: 9cec9e5e-895f-5d12-ad93-38f9460f2033 status: experimental description: Detects Zoom.exe launching a shell handler process (explorer.exe, rundll32.exe, cmd.exe) with a UNC path argument, consistent with exploitation of the Zoom Windows client UNC link handling flaw. references: - IPA advisory on Zoom Windows client UNC injection flaw author: Vorant tags: - attack.T1204.002 - attack.T1187 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \\Zoom.exe Image|endswith: - \\explorer.exe - \\rundll32.exe - \\cmd.exe CommandLine|contains: \\\\ filter: CommandLine|contains: - C:\\ - D:\\ condition: selection and not filter falsepositives: - Legitimate corporate use of UNC paths to internal file shares referenced in chat links - Users pasting internal network share paths for collaboration purposes level: high ``` ### Outbound SMB Connection Initiated by Zoom Client Process ATT&CK: T1187 Detects Zoom.exe or its helper processes initiating outbound SMB (port 445/139) connections, which may indicate automatic NTLM authentication triggered by a malicious UNC link clicked in Zoom chat. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Outbound SMB Connection Initiated by Zoom Client Process id: 5deecf23-1fcb-58bb-a72f-ddb4d27376e7 status: experimental description: Detects the Zoom Windows client process initiating an outbound SMB connection, consistent with forced NTLM authentication triggered by clicking a crafted UNC hyperlink in Zoom chat. references: - IPA advisory on Zoom Windows client UNC injection flaw author: Vorant tags: - attack.T1187 logsource: category: network_connection product: windows detection: selection: Image|endswith: - \\Zoom.exe - \\CptHost.exe - \\ZoomUCWinExt.exe DestinationPort: - 445 - 139 Initiated: 'true' filter: DestinationIp|startswith: - '10.' - 192.168. - 172.16. condition: selection and not filter falsepositives: - Legitimate corporate SMB shares reachable via internal IP ranges not covered by the filter - Split-tunnel VPN configurations exposing internal file share addressing as external ranges level: medium ``` ### Process Execution from Remote UNC Share Spawned by Zoom Client ATT&CK: T1204.002 Detects a child process image path residing on a remote UNC share and spawned directly by the Zoom Windows client, indicating execution of a remote executable via a malicious chat link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Process Execution from Remote UNC Share Spawned by Zoom Client id: 536727a9-f062-5da2-956d-9348ecaed7de status: experimental description: Detects Zoom.exe spawning a child process whose image path is a UNC network path, consistent with arbitrary executable execution triggered from a crafted Zoom chat link. references: - IPA advisory on Zoom Windows client UNC injection flaw author: Vorant tags: - attack.T1204.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \\Zoom.exe Image|startswith: \\\\ condition: selection falsepositives: - Organizations that deploy applications directly from mapped network shares as standard practice level: high ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200403.html --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/964bc3b7-e317-4518-945d-da3490915852/zoom-windows-client-unc-injection-flaw. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup