Zscaler Client Connector

The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.

Local Privilege Escalation via lack of input validation

Multiple Arbitrary Creates/Overwrites by link following

Out-of-bounds write to heap in pacparser

ZCC on Linux privilege escalation

Insecure MacOS code sign check fallback

Anti-Tampering bypass via Repair App functionality

A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.

Linux ZCC allows unsigned updates, allowing elevated Code Execution

Output encoding missing in redrurl parameter

The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.

The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.

The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges.

Lack of input santization on Zscaler Client Connector enables arbitrary code execution

Heap Based Buffer Overflow in Library

ZScalerService Local Privilege Escalation

Revert password check incorrect type validation

Privilege Escalation for ZCC macOS via PATH Variable

Signature validation issue leads to Anti-Tampering bypass

ZApp Installer Privilege Escalation Vulnerabilities

Anti-tampering can be disabled with uninstall password enforced

Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control

IPC Bypass Through PLT Section in ELF

Client IPC validation bypass

Untrusted Search Path While Executing REG DELETE by Uninstaller

Incorrect signature validation of package

Local Privilege Escalation on Zscaler Client Connector on Windows

Repair App local code execution with arbitrary privileges

DHCP routing options can manipulate interface-based VPN traffic

ZCC Mac validinstaller file integrity check missing

ZSATrayManager Arbitrary File Deletion

LPE using arbitrary file delete with Symlinks

Zscaler bypass with administrative privileges on Windows

Traffic being bypassed by ZCC by configuring synthetic IP range as local network

PAC Files Exposed to Internet Websites

Signature validation error in DLL allows disabling anti-tampering protection

Junction Delete leading to elevation of privilege

ZCC macOS Upgrade ZIP Bomb DoS

Privilege Escalation Using PID Reuse in ZCC macOS

Disable Zscaler using machine tunnel restart