another day, another set of misrepresented vulnerabilities from the security consultancy vuln mill:<p>1) Zoom client application chat Giphy arbitrary file write<p>This is not an 'arbitrary file write'. There is virtually no 'arbitrary file write' that doesn't lead to code execution on Windows. The reason is detailed in the report itself:<p>> The severity of this vulnerability is partially mitigated by the fact that Zoom client will append a string _BigPic.gif to the specified filename. This prevents the attacker from creating a fully controlled file with arbitrary extension.<p>Nobody is getting hacked by downloading a corrupt .gif file.<p>2) Zoom Client Application Chat Code Snippet Remote Code Execution Vulnerability<p>This is not an 'arbitrary file write', as even in the most user input intensive scenario it is restricted. It's not a 'remote code execution', either as they clearly detail in the last paragraph:<p>> In summary, this vulnerability can be abused in two above outlined scenarios. First, without user interaction, it can be abused to plant arbitrary binaries on target system albeit at a constrained path potentially used in exploiting another vulnerability. Secondly with user interaction, plant binaries at almost arbitrary paths and can potentially overwrite important files and lead to arbitrary code execution.<p>The report itself <i>does not</i> detail the actual way this reaches remote code execution, saying only:<p>> This in itself could potentially be abused in leveraging another vulnerability.<p>However, they could presumably extract the exe to %APPDATA%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, which would cause remote code execution when the user logs in again. I would be surprised if the reality isn't they tried this and they couldn't do it. I don't understand why they cut this so short.<p>It's pretty normal for me to be able to drop an .exe in various places. That's what happens when a website triggers a download. The important thing here is the 'execution' of remote code execution, which they have failed to demonstrate.<p>This is an endless frustration as a vulnerability researcher. Security consultancies, trying to fish for contracts are endlessly willing to misrepresent bugs and security issues they find as much as possible, and there's very little accountability for this.