PT-2023-3411 · Cloudflare · Cloudflare Warp Client For Windows

Ncabetecf · Published 2023-06-20 · Updated 2023-06-29 · CVE-2023-1862

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cloudflare WARP client for Windows versions up to 2023.3.381.0

Description The issue is related to insufficient access control policy on an IPC Named Pipe, allowing a malicious actor to remotely access the warp-svc.exe binary. This could enable an attacker to trigger WARP connect and disconnect commands, as well as obtain network diagnostics and application configuration from the target's device. Exploitation requires specific conditions, including the target's device being reachable on port 445 and allowing authentication with NULL sessions or having knowledge of the target's credentials.

Recommendations For Cloudflare WARP client for Windows versions up to 2023.3.381.0, update to a version later than 2023.3.381.0 to resolve the issue. As a temporary workaround, consider restricting access to the warp-svc.exe binary and limiting authentication to prevent NULL sessions or unauthorized access. Additionally, ensure that port 445 is not reachable from untrusted networks to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-03588

CVE-2023-1862

GHSA-Q55R-53C8-5642

Affected Products

Cloudflare Warp Client For Windows

References · 6

• https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03588 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1862 · Security Note
• https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release · Note
• https://developers.cloudflare.com/warp-client/get-started/windows · Note