Zoom macOS installer flaw enables root escalation
Researcher Patrick Wardle found local privilege-escalation and library-injection bugs in Zoom's macOS client, letting attackers gain root or silently record mic/camera.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Security researcher Patrick Wardle detailed two local security issues in the macOS version of Zoom, discovered while investigating the app's use of the deprecated AuthorizationExecuteWithPrivileges API. The first issue is a race-condition-style privilege escalation: Zoom's installer copies a bash script (runwithroot) to a world-writable temporary directory before executing it as root via security_authtrampoline, allowing any local unprivileged user or malware to subvert the script and gain root access during install or upgrade.
The second issue stems from Zoom's Hardened Runtime entitlements, which include com.apple.security.cs.disable-library-validation. This exception permits arbitrary, unsigned libraries to be loaded into Zoom's process space, defeating the protections Hardened Runtime is meant to provide. Wardle demonstrated 'dylib proxying' — replacing a legitimate library (libssl.1.0.0.dylib) with a malicious proxy that re-exports the original functionality — to inject code into Zoom that inherits the app's user-approved microphone and camera access, enabling covert audio/video recording or silent background launches (via 'open -j') without triggering macOS's privacy prompts.
The post also recaps Zoom's broader track record of security/privacy issues (the 2019 camera-hijack 0day and hidden local web server forcibly removed by Apple's Malware Removal Tool, and iOS-to-Facebook data leakage), framing these new findings as consistent with a pattern of weak security engineering. No CVE identifiers are cited; the issues were disclosed directly via the blog with no confirmed in-the-wild exploitation, though Wardle recommends detection tools (OverSight, KnockKnock) as mitigation given Zoom's surge in enterprise use during pandemic-driven remote work.
Detection guidance
World-Writable Temp File Execution with Root Privileges via AuthorizationExecuteWithPrivileges
A behavioural hunt for the technique in general.
Detects execution of scripts from world-writable directories as root via security_authtrampoline, typical of installer privilege-escalation race conditions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: World-Writable Temp File Execution with Root Privileges via AuthorizationExecuteWithPrivileges
description: Detects execution of shell scripts from world-writable temporary directories
(e.g., /tmp, /var/tmp) as root via security_authtrampoline or AuthorizationExecuteWithPrivileges.
This pattern indicates a race-condition privilege escalation where an installer
copies a script to a world-writable location and executes it with elevated privileges,
allowing local privilege escalation.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains: security_authtrampoline
Image|endswith:
- /bash
- /sh
- /zsh
CommandLine|contains:
- /tmp/
- /var/tmp/
filter_legitimate_installers:
ParentCommandLine|contains:
- Xcode
- homebrew
condition: selection and not filter_legitimate_installers
falsepositives:
- Legitimate macOS installers or system update processes executing scripts from temp
directories with proper authorization prompts
level: high
id: bfabf235-fa83-5362-9d0c-6ead247d4a31
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x56.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs