Zoom macOS installer flaw enables root escalation

Researcher Patrick Wardle found local privilege-escalation and library-injection bugs in Zoom's macOS client, letting attackers gain root or silently record mic/camera.

Security researcher Patrick Wardle detailed two local security issues in the macOS version of Zoom, discovered while investigating the app's use of the deprecated AuthorizationExecuteWithPrivileges API. The first issue is a race-condition-style privilege escalation: Zoom's installer copies a bash script (runwithroot) to a world-writable temporary directory before executing it as root via security_authtrampoline, allowing any local unprivileged user or malware to subvert the script and gain root access during install or upgrade.

The second issue stems from Zoom's Hardened Runtime entitlements, which include com.apple.security.cs.disable-library-validation. This exception permits arbitrary, unsigned libraries to be loaded into Zoom's process space, defeating the protections Hardened Runtime is meant to provide. Wardle demonstrated 'dylib proxying' — replacing a legitimate library (libssl.1.0.0.dylib) with a malicious proxy that re-exports the original functionality — to inject code into Zoom that inherits the app's user-approved microphone and camera access, enabling covert audio/video recording or silent background launches (via 'open -j') without triggering macOS's privacy prompts.

The post also recaps Zoom's broader track record of security/privacy issues (the 2019 camera-hijack 0day and hidden local web server forcibly removed by Apple's Malware Removal Tool, and iOS-to-Facebook data leakage), framing these new findings as consistent with a pattern of weak security engineering. No CVE identifiers are cited; the issues were disclosed directly via the blog with no confirmed in-the-wild exploitation, though Wardle recommends detection tools (OverSight, KnockKnock) as mitigation given Zoom's surge in enterprise use during pandemic-driven remote work.

title: Suspicious Library Loaded by Zoom with Disabled Code Signature Validation
description: Detects Zoom.app loading unsigned or non-standard dylib files that would
  normally be blocked by Hardened Runtime. Attackers exploit com.apple.security.cs.disable-library-validation
  entitlement to inject malicious libraries (e.g., dylib proxies replacing libssl.1.0.0.dylib)
  into the Zoom process.
tags:
- attack.defense-evasion
- attack.t1574.006
logsource:
  category: image_load
  product: macos
detection:
  selection:
    Image|contains: /Zoom.app/
    ImageLoaded|endswith:
    - .dylib
    - .so
    Signed: 'false'
  filter_system_libs:
    ImageLoaded|startswith:
    - /usr/lib/
    - /System/Library/
  condition: selection and not filter_system_libs
falsepositives:
- Zoom plugins or third-party extensions legitimately loading unsigned dylibs during
  development
level: high
id: 890e026d-703f-55b0-8b9f-36499e627302
status: experimental
author: Vorant

title: World-Writable Temp File Execution with Root Privileges via AuthorizationExecuteWithPrivileges
description: Detects execution of shell scripts from world-writable temporary directories
  (e.g., /tmp, /var/tmp) as root via security_authtrampoline or AuthorizationExecuteWithPrivileges.
  This pattern indicates a race-condition privilege escalation where an installer
  copies a script to a world-writable location and executes it with elevated privileges,
  allowing local privilege escalation.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains: security_authtrampoline
    Image|endswith:
    - /bash
    - /sh
    - /zsh
    CommandLine|contains:
    - /tmp/
    - /var/tmp/
  filter_legitimate_installers:
    ParentCommandLine|contains:
    - Xcode
    - homebrew
  condition: selection and not filter_legitimate_installers
falsepositives:
- Legitimate macOS installers or system update processes executing scripts from temp
  directories with proper authorization prompts
level: high
id: bfabf235-fa83-5362-9d0c-6ead247d4a31
status: experimental
author: Vorant

title: Zoom Installer Copying Executable to World-Writable Directory
description: Detects Zoom installer (or related processes) writing executable bash/shell
  scripts to world-writable temporary directories such as /tmp or /var/tmp. This is
  a necessary precursor to the race-condition privilege-escalation vulnerability where
  the script is then executed as root.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: file_event
  product: macos
detection:
  selection:
    Image|contains:
    - Zoom
    - zoom
    TargetFilename|contains:
    - /tmp/
    - /var/tmp/
    TargetFilename|endswith:
    - .sh
    - .bash
    CreationReason|contains:
    - write
    - create
  filter_legitimate_temp:
    TargetFilename|contains: .dmg
  condition: selection and not filter_legitimate_temp
falsepositives:
- Zoom updates or installations legitimately extracting temporary files to standard
  temp directories (though best practice would use secure, user-owned directories)
level: medium
id: 46a81d76-a4d6-5f0f-9f17-790487357032
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x56.html