Cloudflare WARP Client up to 2023.3.381.0 on Windows warp-svc.exe access control

Summaryinfo

A vulnerability classified as critical was found in Cloudflare WARP Client up to 2023.3.381.0 on Windows. The impacted element is an unknown function of the file warp-svc.exe. The manipulation results in access control. This vulnerability was named CVE-2023-1862. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Cloudflare WARP Client up to 2023.3.381.0 on Windows (Cloud Software). It has been classified as critical. Affected is an unknown function of the file warp-svc.exe. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials.

The weakness was presented 06/20/2023 as GHSA-q55r-53c8-5642. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-1862 since 04/05/2023. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/04/2023). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Cloud Software

Vendor

• Cloudflare

Name

• WARP Client

Version

• 2023.3.381

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion