CVE-2020-6109: 
NixOS vulnerability analysis and mitigation

An exploitable path traversal vulnerability exists in the Zoom client version 4.6.10 that affects the processing of messages containing animated GIFs. The vulnerability, identified as CVE-2020-6109, was discovered in June 2020 and allows attackers to perform arbitrary file writes through specially crafted chat messages (Talos Intelligence, Hacker News).

The vulnerability leverages Zoom's XMPP-based chat functionality with GIPHY service integration. The flaw exists because the client application doesn't validate the source of GIF files and doesn't sanitize filenames, allowing for directory traversal. The vulnerability received a CVSSv3 score of 8.5 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (Talos Intelligence).

The vulnerability could allow attackers to write arbitrary files to any location writable by the current user on the target system. While the application appends '_BigPic.gif' to specified filenames, attackers could potentially abuse this to aid in the exploitation of other vulnerabilities or affect system configurations. On Windows systems with NTFS, alternative streams could be abused to create files with arbitrary extensions (Talos Intelligence).

Exploitation requires sending a specially crafted chat message to a target user or group. The vulnerability can be triggered with minimal user interaction, and no destination URL validation is performed, allowing the client to follow URLs to arbitrary servers (Talos Intelligence, Hacker News).

Zoom patched this vulnerability with the release of version 4.6.12 of its video conferencing software for Windows, macOS, and Linux computers. The fix was implemented server-side, though researchers noted that a client-side fix was also necessary for complete resolution (Hacker News, Talos Blog).