CVE-2025-64738

Executive Summary

CVE-2025-64738 is a medium-severity vulnerability in Zoom Workplace for macOS that allows an authenticated local attacker to control file names or paths, leading to unauthorized disclosure of information. The vulnerability exists in versions prior to 6.5.10 and is classified under CWE-73 (External Control of File Name or Path). With a CVSS score of 5.0, it requires local access and authentication, but no user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild. No public exploit code or proof-of-concept is currently available. The patch involves upgrading to version 6.5.10.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native macOS application vulnerability in Zoom Workplace.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Local (AV:L) – requires physical or remote local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker must have a valid user account on the macOS system.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – sensitive information can be disclosed.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability requires local access, reducing the attack surface, but the potential for information disclosure is significant.

Deep Dive & Mechanics

The vulnerability stems from improper validation of file names or paths within Zoom Workplace for macOS. An authenticated user can manipulate file path inputs to read arbitrary files on the system that the Zoom process has access to. This is a classic path traversal or file inclusion issue.

Root Cause: The application does not sanitize user-supplied file names or paths before using them in file operations. This allows an attacker to use sequences like ../ to escape intended directories and access sensitive files (e.g., configuration files, credentials, or other user data).

Attack Scenario: An authenticated user on macOS launches Zoom Workplace and exploits the vulnerability by providing a malicious file path (e.g., in a file open dialog or via an API call). The application then reads and potentially exposes the contents of that file to the attacker.

Impact: Disclosure of sensitive information such as system configuration, user data, or other application files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses user-supplied path
char *user_path = get_user_input();
FILE *file = fopen(user_path, "r");
if (file) {
    // Read and display file contents
    char buffer[256];
    while (fgets(buffer, sizeof(buffer), file)) {
        printf("%s", buffer);
    }
    fclose(file);
}

Patched Code (Conceptual):

// Patched: Validate and sanitize path
char *user_path = get_user_input();
char *real_path = realpath(user_path, NULL);
if (real_path == NULL) {
    // Handle error
    return;
}
// Check if real_path is within allowed directory
if (strncmp(real_path, ALLOWED_DIR, strlen(ALLOWED_DIR)) != 0) {
    // Deny access
    free(real_path);
    return;
}
FILE *file = fopen(real_path, "r");
if (file) {
    // Read and display file contents
    char buffer[256];
    while (fgets(buffer, sizeof(buffer), file)) {
        printf("%s", buffer);
    }
    fclose(file);
}
free(real_path);

The patched version uses realpath() to resolve symbolic links and relative paths, then verifies that the resolved path is within an allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• macOS system with Zoom Workplace < 6.5.10 installed.
• A valid user account on the system.

Exploitation Steps:

1. Identify a feature in Zoom that accepts file paths (e.g., file upload, screenshot sharing, or custom background selection).
2. Craft a malicious path to traverse directories, e.g., ../../../etc/passwd or ../../../Users/username/.ssh/id_rsa.
3. Submit the path through the vulnerable feature.
4. Observe the response for file contents.

Example Payload:

# Using curl to simulate a local API call (hypothetical)
curl -X POST http://localhost:8080/zoom/api/file \
  -H "Content-Type: application/json" \
  -d '{"path": "../../../etc/passwd"}'

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor for unusual file access patterns by the Zoom process.
2. Look for attempts to read files outside of Zoom's expected directories (e.g., /etc, /Users/*/.ssh).
3. Use endpoint detection and response (EDR) tools to alert on path traversal attempts.

Hunting Query:

-- Example for EDR (e.g., CrowdStrike)
SELECT * FROM process_events
WHERE process_name = 'zoom.us'
AND file_path LIKE '%../%'
OR file_path LIKE '%..\\%'

Indicators of Compromise (IOCs)

• File Paths: Any path containing ../ or ..\\ used in Zoom file operations.
• Process: zoom.us (macOS) attempting to read files outside of its sandbox.
• Network: No specific network IOCs as this is a local vulnerability.
• Registry/Config: No specific registry changes.

Detection Engineering

YARA Rule

rule CVE_2025_64738_Zoom_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Zoom Workplace for macOS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64738"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $zoom_process = "zoom.us"
    condition:
        $zoom_process and $path_traversal
}

Sigma Rule

title: CVE-2025-64738 Zoom Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Zoom Workplace for macOS
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64738
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/zoom.us'
        CommandLine|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in Zoom
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64738 Zoom Path Traversal Attempt"; flow:to_server,established; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Zoom Workplace for macOS to version 6.5.10 or later.
2. Apply the vendor patch as soon as it becomes available.

Long-term Mitigations:

1. Implement strict input validation for all file paths in the application.
2. Use sandboxing or containerization to limit the Zoom process's file system access.
3. Monitor for path traversal attempts using the provided detection rules.
4. Educate users about the risks of running untrusted software.

Workarounds:

• Restrict local user permissions to limit the impact of exploitation.
• Use macOS security features like System Integrity Protection (SIP) and sandboxing.

Valters IT
DevSecOps & Cyber Threat Intelligence