PT-2023-16429 · Cloudflare · Warp Client For Windows

Jan-Luca Gruber + 1 · Published 2023-04-06 · Updated 2023-04-17 · CVE-2023-0652

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WARP Client for Windows versions <= 2022.12.582.0 WARP Client for Windows versions up to 2022.5.309.0

Description The issue allows a malicious attacker to escalate privileges and overwrite SYSTEM protected files by forging the destination of a hardlink created in the ProgramData folder during the repair process of the software. This is possible due to the installer (MSI) allowing the creation of mount points from its ProgramData folder.

Recommendations For WARP Client for Windows versions <= 2022.12.582.0, update to a version later than 2022.12.582.0 to resolve the issue. For WARP Client for Windows versions up to 2022.5.309.0, update to a version later than 2022.5.309.0 to resolve the issue. As a temporary workaround, consider restricting access to the ProgramData folder to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2023-0652

GHSA-XMHJ-9P83-XVW9

Affected Products

Warp Client For Windows

References · 5

• https://github.com/cloudflare/advisories/security/advisories/GHSA-xmhj-9p83-xvw9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0652 · Security Note
• https://developers.cloudflare.com/warp-client/get-started/windows · Note
• https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release · Note