PT-2020-15704 · Cloudflare · Cloudflared

Haynespl · Published 2020-10-02 · Updated 2024-08-21 · CVE-2020-24356

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cloudflared versions prior to 2020.8.1

Description The issue allows for local privilege escalation on Windows systems due to the way cloudflared searches for and reads configuration files. This could be exploited by a malicious entity to execute commands as a privileged user. An unprivileged user can exploit a misconfiguration to escalate privileges and execute system-level commands by creating a malformed config.yaml file in a non-secure directory, such as C:etc, which cloudflared reads from. The config.yaml file can specify a user-controlled log file location, potentially allowing for code execution when any user logs in.

Recommendations For versions prior to 2020.8.1, update to version 2020.8.1 or later to fix the issue. As a temporary workaround, consider restricting access to the C:etc directory and ensuring that only authorized users can create or modify configuration files. Additionally, restrict the ability of cloudflared to write to arbitrary locations on the system by configuring it to log to a secure, non-executable location.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-24356

GHSA-HGWP-4VP4-QMM2

GO-2022-0845

Affected Products

Cloudflared

References · 7

• https://osv.dev/vulnerability/GHSA-hgwp-4vp4-qmm2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24356 · Security Note
• https://osv.dev/vulnerability/GO-2022-0845 · Vendor Advisory
• https://github.com/cloudflare/cloudflared/security/advisories/GHSA-hgwp-4vp4-qmm2 · Note
• https://github.com/cloudflare/cloudflared · Note
• https://github.com/cloudflare/cloudflared/commit/9323844ea773b1444460fa09295ab8c01a88d97e · Note