CVE-2026-30904

Executive Summary

CVE-2026-30904 is a low-severity vulnerability affecting Zoom Workplace for iOS prior to version 7.0.0. The flaw is classified as a Protection Mechanism Failure (CWE-200) that allows an authenticated user to disclose sensitive information through physical access to the device. With a CVSS score of 1.8, the risk is minimal due to the requirement for physical access and authentication. No public proof-of-concept (PoC) or exploit code has been identified, and the EPSS score is 0.0%, indicating a very low likelihood of exploitation in the wild. The vendor has released a fix in version 7.0.0.

Supply Chain & Package Security

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby). It is a native iOS application issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 1.8 (Low)
• Attack Vector (AV): Physical (P) – The attacker must have physical access to the device.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker must be an authenticated user of the device.
• User Interaction (UI): None (N) – No user action required beyond authentication.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low. Exploitation requires physical access and authentication, significantly limiting the attack surface.

Deep Dive & Mechanics

The vulnerability stems from a protection mechanism failure in Zoom Workplace for iOS. The exact nature of the flaw is not publicly detailed, but it likely involves improper handling of sensitive data (e.g., cached messages, call logs, or credentials) that can be accessed by an authenticated user with physical access to the device. This could be due to insufficient sandboxing, insecure data storage, or inadequate access controls within the app.

Attack Scenario:

1. An attacker gains physical access to an unlocked iOS device running Zoom Workplace < 7.0.0.
2. The attacker, already authenticated as the device user, opens the Zoom app.
3. Due to the protection mechanism failure, the attacker can access sensitive information that should be restricted (e.g., private chat history, meeting recordings, or account tokens).
4. The attacker extracts the data via screen capture, file sharing, or other means.

Root Cause: The app fails to enforce proper access controls or data encryption for locally stored sensitive data, allowing an authenticated user to bypass intended restrictions.

Vulnerable vs. Patched Code

Since no specific code diff is publicly available, the following is a hypothetical example of the vulnerability and its fix.

Vulnerable Code (Swift - iOS):

// Vulnerable: Stores sensitive data in plaintext in UserDefaults
class DataManager {
    func saveSensitiveData(data: String) {
        UserDefaults.standard.set(data, forKey: "sensitive_key")
        UserDefaults.standard.synchronize()
    }
    
    func getSensitiveData() -> String? {
        return UserDefaults.standard.string(forKey: "sensitive_key")
    }
}

Patched Code (Swift - iOS):

// Patched: Uses Keychain for secure storage
import Security

class DataManager {
    func saveSensitiveData(data: String) {
        guard let dataToStore = data.data(using: .utf8) else { return }
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: "sensitive_key",
            kSecValueData as String: dataToStore,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        SecItemDelete(query as CFDictionary)
        SecItemAdd(query as CFDictionary, nil)
    }
    
    func getSensitiveData() -> String? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: "sensitive_key",
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        var item: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &item)
        guard status == errSecSuccess, let data = item as? Data else { return nil }
        return String(data: data, encoding: .utf8)
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• iOS device running Zoom Workplace < 7.0.0
• Physical access to the unlocked device
• Basic knowledge of iOS file system and app sandbox

Steps:

1. Unlock the target iOS device.
2. Open the Zoom Workplace app.
3. Navigate to settings or chat history to identify sensitive data exposure.
4. Use iOS screen recording or AirDrop to exfiltrate visible data.
5. Alternatively, use a file manager app (if jailbroken) to access the app's sandbox directory:
   • Path: /var/mobile/Containers/Data/Application/<UUID>/Library/
   • Look for plist files or SQLite databases containing cached data.

No public exploit code is available.

Blue Team (Defensive)

Detection:

• Monitor for unusual physical access to devices (e.g., multiple unlock attempts, screen recording activity).
• Use Mobile Device Management (MDM) to enforce app updates and restrict physical access.
• Enable iOS logging for app crashes and data access attempts.

Hunting:

• Check for Zoom Workplace app version < 7.0.0 on managed devices.
• Review device logs for unauthorized file access or data exfiltration attempts.

Indicators of Compromise (IOCs)

• Application Version: Zoom Workplace for iOS < 7.0.0
• File Paths (if jailbroken):
  • /var/mobile/Containers/Data/Application/<UUID>/Library/Preferences/com.zoom.ZoomMobile.plist
  • /var/mobile/Containers/Data/Application/<UUID>/Library/Caches/
• Behavioral: Unusual screen recording or AirDrop activity on devices with Zoom installed.

Detection Engineering

YARA Rule

rule CVE_2026_30904_Zoom_iOS_DataExfil {
    meta:
        description = "Detects potential data exfiltration from Zoom Workplace for iOS vulnerable to CVE-2026-30904"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $plist = "com.zoom.ZoomMobile.plist"
        $db = "zoom.db"
        $sqlite = "zoom.sqlite"
    condition:
        any of them
}

Sigma Rule

title: Zoom Workplace iOS Data Disclosure via Physical Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2026-30904 via physical access to iOS device
author: Valters IT
date: 2025/04/10
logsource:
    product: ios
    service: unified_log
detection:
    selection:
        EventID: 1001  # Example: App crash or data access event
        ProcessName: "Zoom Workplace"
        Message: "*sensitive*" or "*keychain*" or "*UserDefaults*"
    condition: selection
falsepositives:
    - Legitimate app usage
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-30904 Zoom iOS Data Exfiltration Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"zoom"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Zoom Workplace for iOS to version 7.0.0 or later via the App Store.
2. Enforce device passcodes and auto-lock policies to reduce physical access risk.
3. Use MDM solutions to remotely enforce app updates.

Long-term Measures:

• Implement app-level data encryption using iOS Keychain.
• Conduct regular security audits of iOS app data storage practices.
• Educate users on physical device security (e.g., never leave device unlocked).

Workarounds:

• If update is not possible, restrict physical access to devices and enable remote wipe capabilities.

Valters IT