Vulnerability · Published Aug 3, 2023 · Assigned by cloudflare

CVE-2023-2754Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client

High 7.4

In plain English

A high-severity security flaw in WARP from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.9%top 39.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device.

Affected products (as reported)

Vendor	Product	Versions
Cloudflare	WARP	0 – before 2023.7.160.0

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release release-notes
https://github.com/cloudflare/advisories/security/advisories/GHSA-mv6g-7577-vq4w vendor-advisory
https://developers.cloudflare.com/warp-client/ product