CVE-2023-22880: Zoom Rooms Information Disclosure Flaw

CVE-2023-22880 Overview

CVE-2023-22880 is an information disclosure vulnerability affecting multiple Zoom products for Windows, including Zoom for Windows clients, Zoom Rooms for Windows clients, and Zoom VDI for Windows clients. The vulnerability stems from a problematic interaction between Zoom clients and the Microsoft Edge WebView2 runtime, where a recent update caused text to be transmitted to Microsoft's online Spellcheck service instead of using the local Windows Spellcheck feature.

This unintended data transmission creates a significant privacy concern as potentially sensitive information typed within Zoom applications—including meeting chats, messages, and other user input—could be sent to external Microsoft servers without user knowledge or consent.

Critical Impact

Sensitive user text input, including meeting content and private communications, may be inadvertently transmitted to external Microsoft servers through the WebView2 runtime spellcheck feature.

Affected Products

• Zoom for Windows clients before version 5.13.3
• Zoom Rooms for Windows clients before version 5.13.5
• Zoom VDI for Windows clients before version 5.13.1

Discovery Timeline

• 2023-03-16 - CVE-2023-22880 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-22880

Vulnerability Analysis

This information disclosure vulnerability (CWE-200) occurs due to an unexpected behavioral change in the Microsoft Edge WebView2 runtime component used by Zoom Windows clients. The WebView2 runtime is a Microsoft component that allows applications to embed web content using the Microsoft Edge rendering engine.

A Microsoft update to the WebView2 runtime changed the default spellcheck behavior, causing text entered within Zoom applications to be transmitted to Microsoft's cloud-based spellcheck service for processing. This represents a network-accessible information exposure path that requires no user interaction to trigger—any text typed by users in affected Zoom clients would automatically be sent to external servers.

The vulnerability has a high impact on confidentiality as sensitive meeting content, chat messages, and other user-entered text could be exposed. However, there is no impact on integrity or availability of the affected systems.

Root Cause

The root cause of this vulnerability lies in the interaction between Zoom's use of the Microsoft Edge WebView2 runtime and Microsoft's telemetry behavior changes. When Microsoft updated the WebView2 runtime, it altered the default spellcheck functionality to utilize cloud-based spelling correction services rather than the local Windows spellcheck capabilities. Zoom's client applications did not account for this behavioral change, resulting in unintended data transmission to Microsoft servers.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. The vulnerability is exploited passively—simply by using an affected Zoom client, users inadvertently transmit their typed text to external servers. While this is not a traditional exploitation scenario involving malicious actors, it represents a significant privacy breach where:

1. Users type content within Zoom applications (chat, meeting notes, etc.)
2. The WebView2 runtime intercepts this text for spellcheck purposes
3. Text is transmitted to Microsoft's online spellcheck service
4. Potentially sensitive information is exposed to external servers without user consent

This vulnerability does not require any malicious code or exploitation attempt—it occurs automatically during normal application usage.

Detection Methods for CVE-2023-22880

Indicators of Compromise

• Unexpected network connections from Zoom processes to Microsoft spellcheck service endpoints
• Outbound HTTPS traffic from Zoom.exe, ZoomRooms.exe, or Zoom VDI client processes to Microsoft telemetry domains
• WebView2 runtime versions prior to 109.0.1481.0 present on systems running affected Zoom clients

Detection Strategies

• Monitor network traffic from Zoom client processes for connections to Microsoft spellcheck and telemetry endpoints
• Audit installed Zoom client versions across enterprise environments to identify versions prior to 5.13.3 (Zoom), 5.13.5 (Zoom Rooms), or 5.13.1 (Zoom VDI)
• Check Microsoft Edge WebView2 runtime version using system inventory tools to identify versions prior to 109.0.1481.0
• Review application proxy logs for unusual data patterns originating from Zoom client processes

Monitoring Recommendations

• Implement endpoint detection rules to alert on Zoom client versions matching affected version ranges
• Deploy network monitoring to track external communications from video conferencing applications
• Establish baseline network behavior for Zoom clients and alert on deviations indicating unexpected data transmission
• Configure SentinelOne agents to monitor for WebView2 runtime component versions and flag outdated installations

How to Mitigate CVE-2023-22880

Immediate Actions Required

• Update Zoom for Windows clients to version 5.13.3 or later immediately
• Update Zoom Rooms for Windows clients to version 5.13.5 or later
• Update Zoom VDI for Windows clients to version 5.13.1 or later
• Alternatively, update Microsoft Edge WebView2 Runtime to version 109.0.1481.0 or later and restart Zoom applications

Patch Information

Zoom has released updated client versions that remediate this vulnerability by disabling the problematic spellcheck feature. The patches are available through Zoom's standard update channels and the Zoom Security Bulletin.

Organizations can also mitigate the vulnerability by updating the Microsoft Edge WebView2 Runtime to version 109.0.1481.0 or later, which modifies Microsoft's telemetry behavior to prevent the unintended data transmission. After updating the WebView2 runtime, Zoom applications must be restarted for the fix to take effect.

Workarounds

• Restrict network access from Zoom clients to Microsoft spellcheck service endpoints at the firewall level as a temporary measure
• Disable browser-based spellcheck features via Group Policy if organizational policies permit
• Consider using Zoom web client or mobile clients temporarily while Windows clients are being updated
• Implement network segmentation to limit exposure of sensitive meeting content during the remediation period

# Verify Zoom client version on Windows systems
# Run in PowerShell to check installed Zoom version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object {$_.DisplayName -like "*Zoom*"} | Select-Object DisplayName, DisplayVersion

# Check WebView2 Runtime version
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" | Select-Object pv