Zscaler – Bypass Disable Service
|Title||Zscaler – Bypass Disable Service|
|Credits||Almaviva Cyber Defence Threat Center|
|Affected products||Zscaler Client Connector|
|Class||Bypass business logic|
|08/11/2021||First report of vulnerability to zscaler|
|11/10/2022||Second report of vulnerability to zscaler|
|04/11/2022||Request for CVE ID (Not Assigned)|
This vulnerability allows the user to rename the system folders of the Zscaler Client Connector, blocking the services’ restart, configuring the agent in Turn Off and to navigate the web while avoiding the requests’ redirect through the protected tunnel.
Inside the product’s folder, that by default is
C:\Program Files (x86)\Zscaler, you can find the ZSAService folder. By modifying said folder, ZScaler will not be able to function, de facto disabling its protection.
By accessing the ZScaler Client Connector interface and going on the “More” menu, you can force a restart of the services via “Restart Service”. The agent will try to restart it, but it will inevitably fail:
Not capable of repristinating the necessary services, the ZScaler Agent will be set to OFF, not allowing the ZScaler Internet Access manager to detect anomalies.