CVE-2023-2754 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client
An attacker on the local network can view DNS queries from a Windows device using Cloudflare WARP if IPv6 is enabled and specific network conditions are met.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2754?
CVE-2023-2754 is a high-severity vulnerability in Cloudflare WARP, published on 3 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device.
Weakness: CWE-319
Which versions are affected by CVE-2023-2754?
It affects 1 product.
Products include Cloudflare Warp.
How do I fix CVE-2023-2754?
No fix has been published for CVE-2023-2754 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-2754 being exploited?
There is no known exploitation of CVE-2023-2754 in the wild and no public exploit code.
Other vulnerabilities in Cloudflare WARP
- CVE-2022-4428 support_uri validation missing in WARP client for Windows
- CVE-2022-2225 Zero Trust Secure Web Gateway policies bypass using WARP client subcommands
- CVE-2023-1862 Remote access to warp-svc.exe in Cloudflare WARP
- CVE-2023-0652 Local Privilege Escalation in Cloudflare WARP Installer (Windows)
- CVE-2023-1412 Local Privilege Escalation Vulnerability in WARP's MSI Installer