Headline
CVE-2023-1412: Windows desktop client · Cloudflare WARP client docs
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oplock) and symbolic links (which can both be created by an unprivileged user). After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Windows\Installer. The vulnerability lies in the repair function of this MSI. ImpactAn unprivileged (non-admin) user can exploit this vulnerability to perform privileged operations with SYSTEM context, including deleting arbitrary files and reading arbitrary file content. This can lead to a variety of attacks, including the manipulation of system files and privilege escalation. PatchesA new installer with a fix that addresses this vulnerability was released in version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgrade to the latest version and delete any older installers present in their systems.
Products
WARP Client
Get started
Windows
Download Cloudflare WARP for Windows from Microsoft App Center or 1.1.1.1.
Go to your predefined download folder and open the executable file to install WARP.
Follow the instructions to complete installation. Cloudflare WARP will automatically launch and appear in your menu bar with the Cloudflare logo.
Select Next and Accept Cloudflare’s privacy policy.
Turn on the toggle to enable WARP.
WARP is now running and protecting your Internet connection.
WARP modes
The WARP app has two main modes of operation: WARP and 1.1.1.1.
In WARP mode, all traffic leaving your computer is encrypted and sent over WARP, including DNS traffic. In 1.1.1.1 mode, the WARP app only encrypts DNS traffic to the 1.1.1.1 resolver.
WARP mode is the default and the recommended mode of operation. However, if you only want to use the 1.1.1.1 resolver mode:
- Select the WARP app icon.
- Select the cog icon, and choose your preferred mode of operation for WARP.
WARP options
Beyond the two modes of operation, the WARP app lets you configure additional options to better suit your needs. You can change the protocol used to connect to Cloudflare or enable 1.1.1.1 for Families, for example. To access these options:
- Select the WARP app icon.
- Select the cog icon > Preferences.
The following is a list of options you can configure in the Connection tab:
- Disable for all Wi-Fi / wired networks: Check the box corresponding to the network where you want to prevent WARP from working on.
- DNS Protocol: The available options depend on the WARP mode you have enabled:
- WARP: Only available when you have the WARP mode enabled. All DNS traffic encrypted and sent to Cloudflare’s edge.
- HTTPS: All DNS traffic is sent outside the tunnel via DNS over HTTPS.
- TLS: All DNS traffic is sent outside the tunnel via encrypted TLS.
- 1.1.1.1 for Families: Allows you to enable 1.1.1.1 for Families and choose between blocking malware, or blocking malware and adult content.
For the Advanced options, refer to Exclude or include network traffic with WARP for more information.
What Cloudflare places on your device****Cloudflare WARP GUI
This is the main GUI application that you interact with. You can find it in:
- The Start menu > Cloudflare.
- On your disk, in C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe.
Cloudflare WARP service
This is the Windows service that is responsible for establishing the wireguard tunnel and all interaction between Cloudflare’s service endpoint and the client application. You can find it in C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe.
Log files
The Windows application places log files in two locations based on what part of the application is logging information. These logs are included during feedback submission when you check Feedback > Share debug information. You can find the logs for:
- WARP Service: C:\ProgramData\Cloudflare.
- Application GUI Logs: C:\Users<your username>\AppData\Local\Cloudflare.
How to remove the application
- Select the Start menu and search for Settings. You can also press ⊞ Win + i).
- Select Apps > App & Features.
- Scroll down to Cloudflare WARP and select Uninstall.