Insufficient Validation on Override Codes for Always-Enabled WARP Mode

Vulnerability

CVE-2023-3747 concerns a client-side time-bypass in Cloudflare's WARP client (used in 1.1.1.1 + WARP and Zero Trust deployments). Administrators can configure WARP to prevent end users from disabling the VPN and issue override codes that permit temporary disconnection. However, the server does not validate the device's local time when enforcing the override code timeout. By tampering with the system clock, an attacker with local access to the device can effectively extend the allowed disconnection period beyond the administrator-defined limit. All versions of WARP client before the fix are affected [1].

Exploitation

The attacker must have local access to the device (e.g., physical possession or remote desktop with user privileges) and the device must have received a valid override code from the administrator [1]. The attacker obtains the override code (e.g., from the user's screen or logs) or takes advantage of an already granted override session. By changing the device's date and time to an earlier point within the allowed code validity window, the client's local enforcement of the timeout resets or extends the remaining duration. No authentication to Cloudflare servers is required beyond possession of the device [2].

Impact

Successful exploitation defeats the administrator's intent to enforce WARP connectivity. The attacker can keep WARP disabled on the device for an extended period, bypassing the security controls designed for Zero Trust environments. This results in a loss of integrity of the policy enforcement (compromise of the WARP client's safe mode) and potentially exposes the device to threats that WARP would have mitigated (e.g., unencrypted traffic, malware). The privilege level is local user; the scope is confined to the affected device [1][2].

Mitigation

Cloudflare released a fix for this vulnerability on 2023-09-07. Administrators should upgrade WARP clients to the latest version available through the official download channels for Windows, macOS, iOS, Android, and Linux [1][2]. No workaround exists for unpatched clients; the feature lock must remain enabled with override code controls, but the local time manipulation vector remains until the update is applied. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.