High severity · published Oct 28, 2022
CVE-2022-3321
Lock WARP switch feature bypass on WARP mobile client for iOS
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WARP · Cloudflare
before 6.14 · source: vendor
WM
Warp Mobile Client · Cloudflare
before 6.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3321
Third Party Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78
More from WARP
9.8
CVE-2022-3320
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
8.8
CVE-2022-3512
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
8.5
CVE-2022-3337
Lock WARP switch bypass by removing VPN profile on iOS mobile client
8.0
CVE-2022-4428
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the…
7.8
CVE-2023-0652
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a…