Saint Giphy, Who Saved GIFs Wherever

Patron of lockdown video calls, animated GIFs in chat, and file names that start with "../".

Life

On 8 June 2020 CVE-2020-6109 was published, found by Cisco Talos in Zoom client 4.6.10. In chat, a message with the "giphy" extension told the client where to fetch an animated GIF and what name to save it under; but the name was never cleaned, and with a few "../" the file landed in any folder the user could write to, opening the way to code execution. Zoom had fixed it on 21 April, in the middle of the pandemic, while half the world lived on video calls.

Prayer

O Saint Giphy, who carries animated kittens into the wrong folders, let our clients check the name before opening the door. Amen.

How to celebrate

Celebrated by updating the Zoom client and cleaning every file name that arrives from the network, before sending yet another cat GIF.