Local information exposure in Zoom Clients

Vulnerability

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows prior to version 5.12.6 does not properly clear data from a local SQL database after a meeting ends. Additionally, the database is encrypted using an insufficiently secure per-device key. This allows a local malicious user to access meeting information from the previous meeting attended by the local user. [1]

Exploitation

An attacker must have local access to the affected device and be able to read the local SQL database files. No special privileges are required beyond local user access. The attacker can recover the database and decrypt it using the per-device key, obtaining meeting information such as in-meeting chat from the previous meeting. The vulnerability exists because the data is not cleared after the meeting ends. [1]

Impact

A local attacker can obtain sensitive meeting information, including in-meeting chat messages, from the previous meeting attended by the user. This leads to information disclosure of potentially confidential communications. The attacker does not gain any other privileges or remote access. [1]

Mitigation

Update to Zoom Client for Meetings version 5.12.6 or later. Zoom recommends users update to the latest version to receive fixes and security improvements. [1] If unable to update, users should ensure that no unauthorized local users have access to the device.