CVSS: 8.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4428 – support_uri validation missing in WARP client for Windows
https://notcve.org/view.php?id=CVE-2022-4428
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients). • https://github.com/cloudflare/advisories/security/advisories/GHSA-h3j3-fhqg-66rh • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3320 – Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
https://notcve.org/view.php?id=CVE-2022-3320
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint. Era posible omitir las políticas configuradas para Zero Trust Secure Web Gateway mediante el subcomando warp-cli 'set-custom-endpoint'. El uso de este comando con un punto final inalcanzable provocó que el cliente WARP se desconectara y permitió eludir las restricciones administrativas en un punto final inscrito en Zero Trust. • https://github.com/cloudflare/advisories/security/advisories/GHSA-3868-hwjx-r5xf • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3512 – Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
https://notcve.org/view.php?id=CVE-2022-3512
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint. Al utilizar el comando warp-cli ""add-trusted-ssid"", un usuario pudo desconectar el cliente WARP y omitir la función ""Lock WARP switch"", lo que provocó que las políticas Zero Trust no se aplicaran en un terminal afectado. • https://github.com/cloudflare/advisories/security/advisories/GHSA-3868-hwjx-r5xf • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2225 – Zero Trust Secure Web Gateway policies bypass using WARP client subcommands
https://notcve.org/view.php?id=CVE-2022-2225
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'. Mediante el uso de los subcomandos de warp-cli (disable-ethernet, disable-wifi), era posible a un usuario no privilegiado de administrador omitir las políticas de seguridad configuradas de Zero Trust (por ejemplo, las políticas de Secure Web Gateway) y funciones como "Lock WARP switch". • https://github.com/cloudflare/advisories/security/advisories/GHSA-cg88-vx48-976c • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2145 – Cloudlfare WARP Arbitrary File Overwrite
https://notcve.org/view.php?id=CVE-2022-2145
Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files. El cliente WARP de Cloudflare para Windows (versiones hasta 2022.5.309.0) permitía la creación de puntos de montaje desde su carpeta ProgramData. Durante la instalación del cliente WARP, era posible escalar privilegios y sobrescribir archivos protegidos por el sistema • https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq • CWE-20: Improper Input Validation CWE-59: Improper Link Resolution Before File Access ('Link Following') •