Local Privilege Escalation Vulnerability in WARP's MSI Installer

CVE-2023-1412

What is CVE-2023-1412?

The vulnerability occurs in the installer of the Cloudflare WARP Client for Windows, where an unprivileged user can utilize an improper access control mechanism. By creating opportunistic locks and symbolic links, these users could perform privileged operations with SYSTEM context, such as deleting or reading arbitrary files. This flaw escalates privileges without requiring administrative rights, posing significant security risks. Users are advised to upgrade to version 2023.3.381.0 or later to mitigate this issue and remove older installers from their systems.

References