Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows

Vulnerability

Cloudflare WARP for Windows versions prior to 1.2.2695.1 have an unquoted service path vulnerability. The service binary path for the WARP service lacks quotes, enabling a local attacker to insert a malicious executable into an intermediate path that Windows will execute with SYSTEM privileges [1].

Exploitation

An attacker with non-administrative access to the system can place a crafted executable named to match a path segment (e.g., C:\Program.exe) that Windows will execute before the legitimate service binary. No user interaction is required beyond the ability to write to a directory in the unquoted path [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with SYSTEM privileges, achieving full privilege escalation to administrator [1].

Mitigation

The vulnerability is fixed in Cloudflare WARP for Windows version 1.2.2695.1 by adding quotes around the service binary path. Users should update to this version or later [1].