support_uri validation missing in WARP client for Windows

support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

输入验证不恰当

Cloudflare WARP 输入验证错误漏洞

Cloudflare WARP（Cloudflare Vpn）是美国Cloudflare公司的一个用于安全连接的客户端应用软件。 Cloudflare WARP存在安全漏洞，该漏洞源于其客户端本地设置文件（mdm.xml）中的support_uri参数缺乏适当的验证允许攻击者提升权限，并在单击“Send feedback”选项时在本地机器上启动任意可执行文件。具有本地文件系统访问权限的攻击者可以使用指向恶意文件的精心制作的XML配置文件，或者使用Cloudflare Zero Trust Dashboar

N/A

N/A