PT-2023-16429 · Cloudflare · Warp Client For Windows

Jan-Luca Gruber + 1 · Publicado 2023-04-06 · Atualizado 2023-04-17 · CVE-2023-0652

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WARP Client for Windows versions <= 2022.12.582.0 WARP Client for Windows versions up to 2022.5.309.0

Description The issue allows a malicious attacker to escalate privileges and overwrite SYSTEM protected files by forging the destination of a hardlink created in the ProgramData folder during the repair process of the software. This is possible due to the installer (MSI) allowing the creation of mount points from its ProgramData folder.

Recommendations For WARP Client for Windows versions <= 2022.12.582.0, update to a version later than 2022.12.582.0 to resolve the issue. For WARP Client for Windows versions up to 2022.5.309.0, update to a version later than 2022.5.309.0 to resolve the issue. As a temporary workaround, consider restricting access to the ProgramData folder to minimize the risk of exploitation.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2023-0652

GHSA-XMHJ-9P83-XVW9

Produtos afetados

Warp Client For Windows

Referências · 5

• https://github.com/cloudflare/advisories/security/advisories/GHSA-xmhj-9p83-xvw9 · Aviso do Fabricante
• https://developers.cloudflare.com/warp-client/get-started/windows · Nota
• https://osv.dev/vulnerability/CVE-2023-0652 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0652 · Nota de Segurança
• https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release · Nota