CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1412 – Local Privilege Escalation Vulnerability in WARP's MSI Installer
https://notcve.org/view.php?id=CVE-2023-1412
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oplock) and symbolic links (which can both be created by an unprivileged user). After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Windows\Installer. The vulnerability lies in the repair function of this MSI. ImpactAn unprivileged (non-admin) user can exploit this vulnerability to perform privileged operations with SYSTEM context, including deleting arbitrary files and reading arbitrary file content. This can lead to a variety of attacks, including the manipulation of system files and privilege escalation. PatchesA new installer with a fix that addresses this vulnerability was released in version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgrade to the latest version and delete any older installers present in their systems. • https://developers.cloudflare.com/warp-client/get-started/windows https://github.com/cloudflare/advisories/security/advisories/GHSA-hgxh-48m3-3gq7 https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4428 – support_uri validation missing in WARP client for Windows
https://notcve.org/view.php?id=CVE-2022-4428
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients). • https://github.com/cloudflare/advisories/security/advisories/GHSA-h3j3-fhqg-66rh • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4457 – WARP client manifest misconfiguration leading to Task Hijacking
https://notcve.org/view.php?id=CVE-2022-4457
Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device. • https://github.com/cloudflare/advisories/security/advisories/GHSA-35f7-fqrc-4hhj • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3320 – Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
https://notcve.org/view.php?id=CVE-2022-3320
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint. Era posible omitir las políticas configuradas para Zero Trust Secure Web Gateway mediante el subcomando warp-cli 'set-custom-endpoint'. El uso de este comando con un punto final inalcanzable provocó que el cliente WARP se desconectara y permitió eludir las restricciones administrativas en un punto final inscrito en Zero Trust. • https://github.com/cloudflare/advisories/security/advisories/GHSA-3868-hwjx-r5xf • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3512 – Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
https://notcve.org/view.php?id=CVE-2022-3512
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint. Al utilizar el comando warp-cli ""add-trusted-ssid"", un usuario pudo desconectar el cliente WARP y omitir la función ""Lock WARP switch"", lo que provocó que las políticas Zero Trust no se aplicaran en un terminal afectado. • https://github.com/cloudflare/advisories/security/advisories/GHSA-3868-hwjx-r5xf • CWE-862: Missing Authorization •