support_uri validation missing in WARP client for Windows

CVE-2022-4428

What is CVE-2022-4428?

The WARP client suffers from a vulnerability due to improper validation of the support_uri parameter in its local settings file (mdm.xml). This flaw enables an attacker with access to the local file system to manipulate the XML configuration, allowing them to point to a malicious executable. When a user clicks the 'Send feedback' option, this can lead to the execution of arbitrary code on the local machine. The vulnerability can be exploited via crafted XML files, exploiting the integration with the Cloudflare Zero Trust Dashboard.

References