High severity · published Jan 11, 2023
CVE-2022-4428
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the…
8.0
CVSS
0.7%
EPSS
No
On KEV
Description
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Warp · Cloudflare
through 2022.10.106.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4428
Product
https://github.com/cloudflare/advisories/security/advisories/GHSA-h3j3-fhqg-66rh
More from Warp
9.8
CVE-2022-3320
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
8.8
CVE-2022-3512
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
8.5
CVE-2022-3337
Lock WARP switch bypass by removing VPN profile on iOS mobile client
8.2
CVE-2022-3321
Lock WARP switch feature bypass on WARP mobile client for iOS
7.8
CVE-2023-0652
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a…