PT-2021-7429 · Zoom · Zoom On-Premise Recording Connector+4

Jeremy Brown · Published 2021-06-09 · Updated 2021-11-16 · CVE-2021-34417

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoom On-Premise Meeting Connector Controller versions prior to 4.6.365.20210703 Zoom On-Premise Meeting Connector MMR versions prior to 4.6.365.20210703 Zoom On-Premise Recording Connector versions prior to 3.8.45.20210703 Zoom On-Premise Virtual Room Connector versions prior to 4.4.6868.20210703 Zoom On-Premise Virtual Room Connector Load Balancer versions prior to 2.5.5496.20210703

Description The issue is related to insufficient input validation, which could allow a remote attacker to execute arbitrary code. Specifically, the network proxy page on the web portal for certain Zoom products fails to validate input sent in requests to set the network proxy password, potentially leading to remote command injection by a web portal administrator.

Recommendations For Zoom On-Premise Meeting Connector Controller versions prior to 4.6.365.20210703, update to version 4.6.365.20210703 or later. For Zoom On-Premise Meeting Connector MMR versions prior to 4.6.365.20210703, update to version 4.6.365.20210703 or later. For Zoom On-Premise Recording Connector versions prior to 3.8.45.20210703, update to version 3.8.45.20210703 or later. For Zoom On-Premise Virtual Room Connector versions prior to 4.4.6868.20210703, update to version 4.4.6868.20210703 or later. For Zoom On-Premise Virtual Room Connector Load Balancer versions prior to 2.5.5496.20210703, update to version 2.5.5496.20210703 or later. As a temporary workaround, consider restricting access to the network proxy page on the web portal to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-06165

CVE-2021-34417

Affected Products

Zoom On-Premise Meeting Connector Controller

Zoom On-Premise Meeting Connector Mmr

Zoom On-Premise Recording Connector

Zoom On-Premise Virtual Room Connector

Zoom On-Premise Virtual Room Connector Load Balancer

References · 7

• https://bdu.fstec.ru/vul/2022-06165 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34417 · Security Note
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34417 · Vendor Advisory
• https://t.me/cibsecurity/32273 · Telegram Post
• https://explore.zoom.us/en/trust/security/%D0%B1%D1%8E%D0%BB%D0%BB%D0%B5%D1%82%D0%B5%D0%BD%D1%8C%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8 · Note
• https://t.me/true_secator/2322 · Telegram Post