CVE-2022-22788: Zoom Meetings DLL Injection RCE Vulnerability

CVE-2022-22788 Overview

CVE-2022-22788 is a DLL injection vulnerability affecting the Zoom Opener installer for Zoom Client for Meetings and Zoom Rooms for Conference Room on Windows platforms. The vulnerability occurs when a user downloads the Zoom Opener installer from the Launch meeting page while attempting to join a meeting without having the Zoom Meeting Client installed. Attackers can exploit this flaw to execute arbitrary code on the victim's host system.

Critical Impact

This vulnerability allows attackers to run arbitrary code on victims' hosts through DLL injection during the Zoom Opener installation process, potentially leading to complete system compromise.

Affected Products

• Zoom Client for Meetings before version 5.10.3 (Windows)
• Zoom Rooms for Conference Room before version 5.10.3 (Windows)

Discovery Timeline

• 2022-06-15 - CVE-2022-22788 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22788

Vulnerability Analysis

This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), which enables DLL injection attacks against the Zoom Opener installer. The vulnerability requires local access and user interaction—specifically, a user must download and execute the Zoom Opener installer while malicious DLL files are present in a location that the installer searches during its execution.

The attack exploits Windows' DLL search order mechanism. When the Zoom Opener installer runs, it searches for required DLLs in a predictable sequence of directories. If an attacker can place a malicious DLL in a directory that is searched before the legitimate DLL location, the installer will load and execute the attacker's code with the privileges of the user running the installer.

Root Cause

The root cause is an uncontrolled search path element in the Zoom Opener installer. The application fails to properly validate or restrict the directories from which it loads DLL files, allowing attackers to place malicious DLLs in user-writable locations that are searched during the installation process. This represents a failure to implement secure DLL loading practices, such as using absolute paths or restricting the DLL search path.

Attack Vector

The attack requires local access to the target system and user interaction. An attacker must first plant a malicious DLL in a directory that the Zoom Opener installer will search—commonly the current working directory or user-writable system paths. When the victim downloads and runs the Zoom Opener installer (typically when trying to join a meeting without the full Zoom client installed), the installer loads the malicious DLL, executing arbitrary code with the user's privileges.

This attack is particularly effective in scenarios where users download the installer to their Downloads folder, as attackers who have compromised this location (through phishing, other malware, or shared network drives) can silently execute code during what appears to be a legitimate Zoom installation.

Detection Methods for CVE-2022-22788

Indicators of Compromise

• Unexpected DLL files present in directories where the Zoom Opener installer is downloaded or executed
• Process creation events showing the Zoom Opener installer loading DLLs from non-standard locations
• Unusual child processes spawned by the Zoom installation process

Detection Strategies

• Monitor for DLL loading events from the Zoom Opener installer process, particularly those loading DLLs from user-writable directories such as Downloads or Temp folders
• Implement application whitelisting to prevent unauthorized DLLs from being loaded by installation processes
• Use endpoint detection and response (EDR) solutions to detect anomalous process behavior during Zoom installations

Monitoring Recommendations

• Enable Windows Event Logging for process creation (Event ID 4688) and DLL loading events
• Configure SentinelOne to monitor for suspicious DLL sideloading patterns associated with common installers
• Alert on Zoom installer processes that spawn unexpected child processes or make unusual network connections

How to Mitigate CVE-2022-22788

Immediate Actions Required

• Upgrade Zoom Client for Meetings to version 5.10.3 or later immediately
• Upgrade Zoom Rooms for Conference Room to version 5.10.3 or later
• Verify that the Zoom Opener installer is downloaded from official Zoom sources only
• Clear user Downloads folders of any suspicious DLL files before running Zoom installers

Patch Information

Zoom has addressed this vulnerability in version 5.10.3 and later for both Zoom Client for Meetings and Zoom Rooms for Conference Room on Windows. Organizations should update to the latest available version through official channels. For detailed patch information, consult the Zoom Security Bulletin.

Workarounds

• Run the Zoom installer from a clean, dedicated directory that does not contain any non-essential files
• Pre-install the full Zoom Meeting Client rather than relying on the web-based Zoom Opener installer
• Implement application control policies that restrict DLL loading to trusted system directories
• Use a non-administrative account for daily operations to limit the impact of potential exploitation

# Configuration example: Verify Zoom client version on Windows
# Run in PowerShell to check installed Zoom version
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*Zoom*" } | Select-Object DisplayName, DisplayVersion

# Verify version is 5.10.3 or higher before allowing Zoom usage