CVE-2022-28766: Zoom Meetings DLL Injection RCE Vulnerability

CVE-2022-28766 Overview

CVE-2022-28766 is a DLL injection vulnerability affecting Windows 32-bit versions of the Zoom Client for Meetings and Zoom Rooms for Conference Room prior to version 5.12.6. This vulnerability allows a local low-privileged user to exploit improper DLL loading behavior to execute arbitrary code within the context of the Zoom client process.

DLL injection vulnerabilities occur when an application loads dynamic-link libraries from untrusted locations without proper validation. In this case, the Zoom client fails to securely specify the search path for required DLLs, enabling attackers to plant malicious libraries that get loaded and executed with the same privileges as the Zoom application.

Critical Impact

A local attacker with low privileges can achieve arbitrary code execution in the context of the Zoom client, potentially leading to privilege escalation, data theft, or lateral movement within enterprise environments.

Affected Products

• Zoom Client for Meetings for Windows 32-bit (versions before 5.12.6)
• Zoom Rooms for Conference Room for Windows 32-bit (versions before 5.12.6)

Discovery Timeline

• 2022-11-17 - CVE-2022-28766 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-28766

Vulnerability Analysis

This vulnerability is classified under CWE-427 (Uncontrolled Search Path Element) and CWE-94 (Improper Control of Generation of Code). The flaw exists in how the Zoom client locates and loads DLL files during application startup or runtime operations.

When an application on Windows attempts to load a DLL, the operating system follows a specific search order to locate the library. If an application does not explicitly define a secure search path, Windows may search directories that are writable by low-privileged users. An attacker can exploit this by placing a malicious DLL with a specific name in one of these searched directories.

The vulnerability requires local access and user interaction, meaning an attacker would need to either have existing access to the target system or trick a user into placing the malicious DLL in an accessible location. Once the malicious DLL is loaded, it executes with the full privileges of the Zoom client process.

Root Cause

The root cause of CVE-2022-28766 stems from the Zoom client's failure to implement secure DLL loading practices on Windows 32-bit systems. The application does not properly restrict the search path used when loading dynamic-link libraries, allowing the system to potentially load DLLs from directories where a local attacker could place malicious files. This is a classic example of an uncontrolled search path vulnerability where the application trusts the operating system's default DLL search order rather than explicitly specifying trusted library locations.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have some level of access to the target system. The exploitation scenario typically involves:

1. The attacker identifies a DLL that the Zoom client attempts to load from an insecure location
2. The attacker crafts a malicious DLL with the same filename containing payload code
3. The attacker places this DLL in a directory that appears earlier in the Windows DLL search order
4. When the victim launches or uses the Zoom client, the malicious DLL is loaded instead of the legitimate one
5. The attacker's code executes within the context of the Zoom process

The vulnerability requires user interaction (the victim must launch or use Zoom) but can result in high impact to confidentiality, integrity, and availability as the attacker gains code execution within the application context.

Detection Methods for CVE-2022-28766

Indicators of Compromise

• Unexpected DLL files appearing in Zoom installation directories or user-writable paths
• Unusual DLL loading events from the Zoom client process logged in Windows Event Viewer
• Anomalous child processes spawned by Zoom.exe or ZoomRooms.exe
• Modifications to system PATH environment variables targeting Zoom directories

Detection Strategies

• Monitor DLL loading events using Windows Sysmon (Event ID 7) for the Zoom process loading libraries from non-standard locations
• Implement application whitelisting to detect and block unauthorized DLLs loaded by the Zoom client
• Use endpoint detection and response (EDR) solutions to identify code injection attempts targeting video conferencing applications
• Deploy file integrity monitoring on Zoom installation directories to detect unauthorized file additions

Monitoring Recommendations

• Enable detailed logging for process creation and DLL loading events on systems running Zoom
• Configure alerts for any DLL loads by Zoom processes from user-writable directories such as %TEMP%, %APPDATA%, or the current working directory
• Establish baselines for normal Zoom client behavior and alert on deviations
• Monitor for suspicious process ancestry chains originating from Zoom executables

How to Mitigate CVE-2022-28766

Immediate Actions Required

• Update Zoom Client for Meetings to version 5.12.6 or later on all Windows 32-bit systems
• Update Zoom Rooms for Conference Room to version 5.12.6 or later
• Conduct an inventory of all Zoom installations to identify vulnerable versions
• Consider migrating to 64-bit versions of Zoom where supported to reduce attack surface

Patch Information

Zoom has released version 5.12.6 of both the Zoom Client for Meetings and Zoom Rooms for Conference Room that addresses this DLL injection vulnerability. Organizations should prioritize updating all Windows 32-bit installations. The official security advisory and patch information is available through the Zoom Security Bulletin.

Workarounds

• Restrict write permissions on directories in the DLL search path to prevent unauthorized DLL placement
• Implement application control policies to only allow signed Zoom binaries to execute
• Use Windows Defender Application Control (WDAC) or AppLocker to restrict DLL loading to trusted locations
• Consider deploying Zoom through enterprise deployment tools with locked-down configurations

# Verify Zoom version on Windows systems
# Run in PowerShell to check installed Zoom version
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*Zoom*" } | Select-Object DisplayName, DisplayVersion