CVE-2023-0652CWE-59

Local Privilege Escalation in Cloudflare WARP Installer (Windows)

High · published April 6, 2023

CVSS v3.1
7.0
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files.

As Cloudflare WARP client for Windows (up to version 2022.5.309.0) allowed creation of mount points from its ProgramData folder, during installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2023-04-06T09:42Z
EPSS history
Timeline
  • 06 APR 09:42Z
    Local Privilege Escalation in Cloudflare WARP Installer (Windows)
    cvelistv5