Cloudflare WARP Client prior 2022.12.476.0 on Windows XML File mdm.xml support_uri input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cloudflare WARP Client on Windows. This affects an unknown part of the file mdm.xml of the component XML File Handler. Executing a manipulation of the argument support_uri can lead to input validation. The identification of this vulnerability is CVE-2022-4428. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Cloudflare WARP Client on Windows (Cloud Software). This vulnerability affects an unknown functionality of the file mdm.xml of the component XML File Handler. The manipulation of the argument support_uri with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).

The weakness was shared 01/11/2023 as GHSA-h3j3-fhqg-66rh. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-4428 since 12/12/2022. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

By approaching the search of inurl:mdm.xml it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2022.12.476.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Cloudflare

Name

• WARP Client

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion