CVE-2023-1862
📋 TL;DR
The Cloudflare WARP client for Windows had an insecure IPC Named Pipe that allowed unauthorized remote access. This enabled attackers to trigger WARP connection/disconnection commands and extract network diagnostics and configuration data from affected devices. Users running WARP client versions up to v2023.3.381.0 on Windows are affected.
💻 Affected Systems
- Cloudflare WARP Client for Windows
📦 What is this software?
Warp by Cloudflare
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains unauthorized control over WARP connectivity, disrupts network access, and extracts sensitive network configuration and diagnostic data from the target system.
Likely Case
Unauthorized users trigger WARP disconnects causing network disruption and gather network configuration information from vulnerable systems.
If Mitigated
With proper network segmentation and access controls, impact is limited to network disruption within the segmented environment.
🎯 Exploit Status
Exploitation requires specific network conditions but uses standard Windows IPC mechanisms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v2023.3.381.0
Vendor Advisory: https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642
Restart Required: Yes
Instructions:
1. Update Cloudflare WARP client to latest version. 2. Restart the system or WARP service. 3. Verify version is above v2023.3.381.0.
🔧 Temporary Workarounds
Restrict SMB Access
windowsBlock port 445 access to WARP clients from untrusted networks
netsh advfirewall firewall add rule name="Block SMB WARP" dir=in action=block protocol=TCP localport=445 remoteip=any
Disable NULL Session Authentication
windowsPrevent NULL session authentication on Windows systems
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" /v RestrictNullSessAccess /t REG_DWORD /d 1 /f
🧯 If You Can't Patch
- Segment WARP clients from general network access using firewall rules
- Implement strict access controls on port 445 and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check WARP client version in Settings > About or via PowerShell: Get-WmiObject Win32_Product | Where-Object {$_.Name -like "*Cloudflare*WARP*"} | Select-Object VersionCheck Version:
powershell "Get-WmiObject Win32_Product | Where-Object {$_.Name -like '*Cloudflare*WARP*'} | Select-Object Version"Verify Fix Applied:
Confirm version is above v2023.3.381.0 and test Named Pipe permissions📡 Detection & Monitoring
Log Indicators:
- Unexpected WARP service disconnections
- Unauthorized access attempts to warp-svc.exe
- SMB authentication logs showing NULL sessions
Network Indicators:
- Unusual port 445 traffic to WARP clients
- IPC Named Pipe access patterns
SIEM Query:
EventID=4688 AND ProcessName="warp-svc.exe" AND CommandLine LIKE "%pipe%"🔗 References
- https://developers.cloudflare.com/warp-client/get-started/windows/
- https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642
- https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release
- https://developers.cloudflare.com/warp-client/get-started/windows/
- https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642
- https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release
