Saint XMPP, Smuggler of Stanzas

Patron of XML parsers that disagree, video calls, and messages with a false bottom.

Life

In February 2022 Ivan Fratric of Google Project Zero told Zoom that its client and server read the same XML in different ways. By slipping chosen characters into a chat message, a whole XMPP stanza could escape the message, and the victim's client took it as an order from the server: up to redirecting it to a malicious server and making it install an old version. Zoom fixed it all in 5.10.0; the details went public on 24 May 2022.

Prayer

O Saint XMPP, who hides one message inside another, let client and server speak the same XML. Amen.

How to celebrate

Celebrated by updating Zoom past 5.10.0 and making sure two different parsers never read the same document.

Two parsers, two truths: and the attacker picks his own.