CVE-2024-24697: Zoom SDK Privilege Escalation Vulnerability

CVE-2024-24697 Overview

CVE-2024-24697 is an untrusted search path vulnerability affecting several Zoom 32-bit Windows client products. An authenticated local user can exploit improper search path handling to escalate privileges on the host. The flaw is tracked under CWE-426: Untrusted Search Path and was disclosed in Zoom Security Bulletin ZSB-24004.

The vulnerability requires local access and low privileges, but successful exploitation yields high impact on confidentiality, integrity, and availability. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact
An authenticated local attacker can escalate privileges on Windows hosts running affected 32-bit Zoom clients, gaining elevated control over the system.

Affected Products

Zoom Meeting Software Development Kit (32-bit Windows)
Zoom Rooms
Zoom VDI Windows Meeting Clients
Zoom (Windows client)

Discovery Timeline

2024-02-14 - CVE-2024-24697 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24697

Vulnerability Analysis

The vulnerability stems from how affected 32-bit Zoom Windows clients resolve file paths when loading executable resources such as Dynamic Link Libraries (DLLs). When a Windows process loads a library without specifying a fully qualified path, the operating system searches a defined sequence of directories. If any directory in that sequence is writable by a low-privileged user, an attacker can plant a malicious DLL that gets loaded by the Zoom process.

Because certain Zoom components run with higher privileges or are invoked by privileged contexts, loading attacker-controlled code through the untrusted search path results in privilege escalation. The CWE-426 classification confirms the root issue is insecure path resolution rather than a memory corruption flaw.

Root Cause

The affected 32-bit Zoom binaries fail to enforce safe library loading practices. Specifically, they rely on Windows search order to locate dependencies instead of using absolute paths or restricted search modes such as LOAD_LIBRARY_SEARCH_SYSTEM32. This allows a writable directory earlier in the search order to override a legitimate system DLL.

Attack Vector

An attacker must already have authenticated local access to the target Windows host. The attacker places a crafted DLL in a directory included in the affected client's search path. When the Zoom client or a related service loads the planted library, attacker-controlled code executes in the context of the Zoom process, yielding elevated privileges.

No network access, user interaction beyond normal Zoom usage, or social engineering is required once the malicious DLL is in place. Refer to Zoom Security Bulletin ZSB-24004 for vendor technical details.

Detection Methods for CVE-2024-24697

Indicators of Compromise

Unexpected DLL files in directories adjacent to Zoom installation paths or user-writable folders referenced in PATH.
Zoom processes (Zoom.exe, ZoomRooms.exe, VDI client binaries) loading modules from non-standard locations such as user profile directories.
Newly created or modified DLLs with timestamps that do not match official Zoom installer activity.

Detection Strategies

Monitor module load events (Sysmon Event ID 7) for Zoom binaries loading DLLs from outside Program Files or System32.
Audit file creation events in directories present in the Zoom process search order, flagging DLL drops by non-installer processes.
Correlate Zoom child process creation with unusual parent-child relationships indicating injected code execution.

Monitoring Recommendations

Enable PowerShell and Sysmon logging to capture DLL load telemetry and forward to a centralized analytics platform.
Alert on writes of .dll files to user-writable directories that intersect with the Zoom client's runtime search path.
Track process integrity level transitions for Zoom services to identify privilege elevation attempts.

How to Mitigate CVE-2024-24697

Immediate Actions Required

Inventory all Windows hosts running 32-bit Zoom clients, including Zoom Rooms, VDI Meeting Clients, and the Meeting SDK.
Update affected components to the fixed versions listed in Zoom Security Bulletin ZSB-24004.
Restrict local logon rights on systems where 32-bit Zoom clients cannot be immediately patched.

Patch Information

Zoom released fixed builds addressing the untrusted search path issue. Administrators should consult Zoom Security Bulletin ZSB-24004 for the specific version numbers corresponding to each affected product line and deploy them through standard software distribution channels.

Workarounds

Remove write permissions from directories that appear in the Zoom client's library search order for non-administrative users.
Deploy application control policies (Windows Defender Application Control or AppLocker) to block unsigned DLLs from loading into Zoom processes.
Where feasible, replace 32-bit Zoom clients with 64-bit equivalents that are not listed as affected.

bash

# Example AppLocker rule concept: allow only Zoom-signed DLLs to load from the install directory
# Run in elevated PowerShell
Get-AppLockerPolicy -Effective -Xml > current-policy.xml
# Add a DLL rule scoped to %ProgramFiles(x86)%\Zoom\bin permitting publisher = Zoom Video Communications, Inc.
# Deny DLL loads from %LOCALAPPDATA% and other user-writable paths
Set-AppLockerPolicy -XmlPolicy updated-policy.xml -Merge