PT-2023-16965 · Cloudflare · Cloudflare Warp Client

Ncabetecf · Published 2023-04-05 · Updated 2023-04-12 · CVE-2023-1412

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare WARP Client for Windows versions <= 2022.12.582.0

Description An unprivileged user can exploit an Improper Access Control issue to perform privileged operations with SYSTEM context by using a combination of opportunistic locks and symbolic links. The vulnerability lies in the repair function of the MSI-Installer placed under C:WindowsInstaller after installing the Cloudflare WARP Client. This can lead to attacks including the manipulation of system files and privilege escalation, allowing an attacker to delete arbitrary files and read arbitrary file content.

Recommendations For versions <= 2022.12.582.0, upgrade to version 2023.3.381.0 or later and delete any older installers present in the system to address the vulnerability. As a temporary workaround, consider restricting access to the MSI-Installer under C:WindowsInstaller to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2023-1412

GHSA-HGXH-48M3-3GQ7

Affected Products

Cloudflare Warp Client

References · 6

• https://github.com/cloudflare/advisories/security/advisories/GHSA-hgxh-48m3-3gq7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1412 · Security Note
• https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release · Note
• https://t.me/cibsecurity/61474 · Telegram Post
• https://developers.cloudflare.com/warp-client/get-started/windows · Note