Information disclosure in Zoom client

1) Exposure of Resource to Wrong Sphere

EUVDB-ID: #VU51622

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-28133

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists within the screen lock functionality due to the way the Zoom client for Windows and Linux handles screen sharing. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zoom Workplace Desktop App for Windows: 5.0.0 23168.0427 - 5.5.4 13142.0301

Zoom Workplace Desktop App for Linux: 5.1.418436.0628 - 5.5.2 7011.0206

CPE2.3

• cpe:2.3:a:zoom_video_communications:zoom_client_for_windows:5.0.0:23168.0427:*:*:*:*:*:*
• cpe:2.3:a:zoom_video_communications:zoom_client_for_windows:5.0.1:23502.0430:*:*:*:*:*:*
• cpe:2.3:a:zoom_video_communications:zoom_client_for_windows:5.0.3:24951.0515:*:*:*:*:*:*
• cpe:2.3:a:zoom_video_communications:zoom_client_for_linux:5.1.418436.0628:*:*:*:*:*:*:*
• cpe:2.3:a:zoom_video_communications:zoom_client_for_linux:5.1.422789.0705:*:*:*:*:*:*:*
• cpe:2.3:a:zoom_video_communications:zoom_client_for_linux:5.3.469451.0927:*:*:*:*:*:*:*

External links

https://seclists.org/fulldisclosure/2021/Mar/48
https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt
https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133
https://www.youtube.com/watch?v=SonmmgQlLzg
https://zoom.us/trust/security/security-bulletin

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.