Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-4428— support_uri validation missing in WARP client for Windows

Quick assessment

Affected
Cloudflare WARP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cloudflare WARP（Cloudflare Vpn）是美国Cloudflare公司的一个用于安全连接的客户端应用软件。 Cloudflare WARP存在安全漏洞，该漏洞源于其客户端本地设置文件（mdm.xml）中的support_uri参数缺乏适当的验证允许攻击者提升权限，并在单击“Send feedback”选项时在本地机器上启动任意可执行文件。具有本地文件系统访问权限的攻击者可以使用指向恶意文件的精心制作的XML配置文件，或者使用Cloudflare Zero Trust Dashboar

CVSS 8.9 · High EPSS 0.69% · P51
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-4428

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
support_uri validation missing in WARP client for Windows
Source: CVE Program / CVE List V5
Vulnerability Description
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cloudflare WARP 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cloudflare WARP（Cloudflare Vpn）是美国Cloudflare公司的一个用于安全连接的客户端应用软件。 Cloudflare WARP存在安全漏洞，该漏洞源于其客户端本地设置文件（mdm.xml）中的support_uri参数缺乏适当的验证允许攻击者提升权限，并在单击“Send feedback”选项时在本地机器上启动任意可执行文件。具有本地文件系统访问权限的攻击者可以使用指向恶意文件的精心制作的XML配置文件，或者使用Cloudflare Zero Trust Dashboar
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cloudflare WARP 0 ~ 2022.10.106.0 -

II. Public POCs for CVE-2022-4428

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-4428

请登录查看更多情报信息。

Vendor Advisories for CVE-2022-4428 (1)

IV. Related Vulnerabilities

Same product: WARP
Same vendor: Cloudflare
Same weakness: CWE-20

V. Comments for CVE-2022-4428

No comments yet

Leave a comment