{"answers":{"affected":"3 open source packages ship an affected version, including github.com/cloudflare/cloudflared. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-1314 in the wild and no public exploit code.","fix":"Upgrade github.com/cloudflare/cloudflared to 0.0.0-20230313153246-f686da832f85 or later.","what":"CVE-2023-1314 is a high-severity vulnerability in cloudflared, published on 21 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-1314 and fix it if it is affected.\n\nWhat it is: CVE-2023-1314 is a high-severity vulnerability in cloudflared, published on 21 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-1314 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cloudflare/cloudflared (Go): affected all versions; fixed in 0.0.0-20230313153246-f686da832f85\n- github.com/cloudflare/cloudflared (Go): affected all versions; fixed in 0.0.0-20230313153246-f686da832f85\n- github.com/cloudflare/cloudflared (Go): affected all versions; fixed in 0.0.0-20230313153246-f686da832f85\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-1314/ (Markdown: https://insights.sbomify.com/CVE-2023-1314/index.md)","id":"CVE-2023-1314","markdown":"https://insights.sbomify.com/CVE-2023-1314/index.md","name":"CVE-2023-1314","record":{"aliases":["GHSA-7mjv-x3jf-545x","GO-2023-1652"],"analysis":{"component_type":"desktop_application","fix_type":"upgrade","impacts":["privilege_escalation","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Cloudflare tunnel client","requires_auth":"low_privilege","summary":"Local attackers can escalate privileges by exploiting a world-writable directory in the Windows installer to delete or replace system files.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"cloudflare","cpe":[{"product":"cloudflared","vendor":"cloudflare"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"description":"A vulnerability has been discovered in cloudflared's installer (\u003c= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied on a world-writable directory.\n\nAn attacker with local access to the device (without Administrator rights) can use symbolic links to trick the MSI installer into deleting files in locations that the attacker would otherwise have no access to. By creating a symlink from the world-writable directory to the target file, the attacker can manipulate the MSI installer's repair functionality to delete the target file during the repair process.\n\nExploitation of this vulnerability could allow an attacker to delete important system files or replace them with malicious files, potentially leading to the affected device being compromised.\n\nThe cloudflared client itself is not affected by this vulnerability, only the installer for 32-bit Windows devices.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Local Privilege Escalation Vulnerability in cloudflared's Installer","id":"CVE-2023-1314","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"privilege_escalation","year":"2023"},"n_packages":3,"n_references":2,"next":{"headline":"Cross-site Scripting (XSS) - Reflected in osticket/osticket","id":"CVE-2023-1315"},"packages":[{"ecosystem":"Go","fixed":["0.0.0-20230313153246-f686da832f85"],"introduced":["0"],"last_affected":[],"package":"github.com/cloudflare/cloudflared","purl":null,"source":"GHSA-7mjv-x3jf-545x"},{"ecosystem":"Go","fixed":["0.0.0-20230313153246-f686da832f85"],"introduced":["0"],"last_affected":[],"package":"github.com/cloudflare/cloudflared","purl":"pkg:golang/github.com/cloudflare/cloudflared","source":"GHSA-7mjv-x3jf-545x"},{"ecosystem":"Go","fixed":["0.0.0-20230313153246-f686da832f85"],"introduced":["0"],"last_affected":[],"package":"github.com/cloudflare/cloudflared","purl":"pkg:golang/github.com/cloudflare/cloudflared","source":"GO-2023-1652"}],"prev":{"headline":"Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit","id":"CVE-2023-1313"},"products":["cloudflared"],"published":"2023-03-21","related":[{"cvss_score":6.4,"headline":"Local Privilege Escalation in cloudflared","id":"CVE-2020-24356","kev_date_added":null,"published":"2020-10-02"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-02-26","vendors":["Cloudflare"]},"summary":"Local attackers can escalate privileges by exploiting a world-writable directory in the Windows installer to delete or replace system files.","url":"https://insights.sbomify.com/CVE-2023-1314/"}