CVE-2022-3321 (GCVE-0-2022-3321)

Vulnerability from cvelistv5 – Published: 2022-10-28 09:24 – Updated: 2025-05-08 19:15
VLAI?
Title
Lock WARP switch feature bypass on WARP mobile client for iOS
Summary
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch  on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.
Severity ?
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Cloudflare WARP Affected: 0 , < 6.14 (semver)
Create a notification for this product.
Credits
Josh (joshmotionfans)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:07:06.458Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T19:15:19.020466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-08T19:15:29.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "iOS"
          ],
          "product": "WARP",
          "vendor": "Cloudflare",
          "versions": [
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Endpoint enrolled on Cloudflare Zero Trust (Cloudflare One)\u003cbr\u003e"
            }
          ],
          "value": "Endpoint enrolled on Cloudflare Zero Trust (Cloudflare One)\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Josh (joshmotionfans)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "It was possible to bypass \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch\"\u003eLock WARP switch feature\u003c/a\u003e\u0026nbsp;on the WARP iOS mobile client by enabling both \"Disable for cellular networks\" and \"Disable for Wi-Fi networks\" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform."
            }
          ],
          "value": "It was possible to bypass  Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch \u00a0on the WARP iOS mobile client by enabling both \"Disable for cellular networks\" and \"Disable for Wi-Fi networks\" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        },
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-28T09:24:40.799Z",
        "orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
        "shortName": "cloudflare"
      },
      "references": [
        {
          "url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to specified patched versions.\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to specified patched versions.\n"
        }
      ],
      "source": {
        "advisory": "GHSA-4463-5p9m-3c78",
        "discovery": "EXTERNAL"
      },
      "title": "Lock WARP switch feature bypass on WARP mobile client for iOS",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
    "assignerShortName": "cloudflare",
    "cveId": "CVE-2022-3321",
    "datePublished": "2022-10-28T09:24:40.799Z",
    "dateReserved": "2022-09-26T16:41:00.464Z",
    "dateUpdated": "2025-05-08T19:15:29.857Z",
    "requesterUserId": "25b7b156-39bf-4f6b-8c25-8bc69c5c5e82",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:*\", \"versionEndExcluding\": \"6.14\", \"matchCriteriaId\": \"1150BB9C-25CC-4DD9-9CEB-C5B30AA39D1C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"It was possible to bypass  Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch \\u00a0on the WARP iOS mobile client by enabling both \\\"Disable for cellular networks\\\" and \\\"Disable for Wi-Fi networks\\\" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.\"}, {\"lang\": \"es\", \"value\": \"Fue posible omitir la funci\\u00f3n de interruptor Lock WARP https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch en el cliente m\\u00f3vil WARP iOS habilitando ambos Los cambios \\\"\\\"Disable for cellular networks\\\"\\\" y \\\"\\\"Disable for Wi-Fi networks\\\"\\\" a la vez en la configuraci\\u00f3n de la aplicaci\\u00f3n. Dicha configuraci\\u00f3n provoc\\u00f3 que el cliente WARP se desconectara y permiti\\u00f3 al usuario eludir las restricciones y pol\\u00edticas impuestas por la plataforma Zero Trust.\"}]",
      "id": "CVE-2022-3321",
      "lastModified": "2024-11-21T07:19:17.507",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cna@cloudflare.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L\", \"baseScore\": 6.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.5, \"impactScore\": 4.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 4.2}]}",
      "published": "2022-10-28T10:15:16.683",
      "references": "[{\"url\": \"https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78\", \"source\": \"cna@cloudflare.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cna@cloudflare.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cna@cloudflare.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3321\",\"sourceIdentifier\":\"cna@cloudflare.com\",\"published\":\"2022-10-28T10:15:16.683\",\"lastModified\":\"2024-11-21T07:19:17.507\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"It was possible to bypass  Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch \u00a0on the WARP iOS mobile client by enabling both \\\"Disable for cellular networks\\\" and \\\"Disable for Wi-Fi networks\\\" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.\"},{\"lang\":\"es\",\"value\":\"Fue posible omitir la funci\u00f3n de interruptor Lock WARP https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch en el cliente m\u00f3vil WARP iOS habilitando ambos Los cambios \\\"\\\"Disable for cellular networks\\\"\\\" y \\\"\\\"Disable for Wi-Fi networks\\\"\\\" a la vez en la configuraci\u00f3n de la aplicaci\u00f3n. Dicha configuraci\u00f3n provoc\u00f3 que el cliente WARP se desconectara y permiti\u00f3 al usuario eludir las restricciones y pol\u00edticas impuestas por la plataforma Zero Trust.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@cloudflare.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.5,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"cna@cloudflare.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:*\",\"versionEndExcluding\":\"6.14\",\"matchCriteriaId\":\"1150BB9C-25CC-4DD9-9CEB-C5B30AA39D1C\"}]}]}],\"references\":[{\"url\":\"https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78\",\"source\":\"cna@cloudflare.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"platforms\": [\"iOS\"], \"product\": \"WARP\", \"vendor\": \"Cloudflare\", \"versions\": [{\"lessThan\": \"6.14\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}]}], \"configurations\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Endpoint enrolled on Cloudflare Zero Trust (Cloudflare One)\u003cbr\u003e\"}], \"value\": \"Endpoint enrolled on Cloudflare Zero Trust (Cloudflare One)\\n\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Josh (joshmotionfans)\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"It was possible to bypass \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch\\\"\u003eLock WARP switch feature\u003c/a\u003e\u0026nbsp;on the WARP iOS mobile client by enabling both \\\"Disable for cellular networks\\\" and \\\"Disable for Wi-Fi networks\\\" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.\"}], \"value\": \"It was possible to bypass  Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch \\u00a0on the WARP iOS mobile client by enabling both \\\"Disable for cellular networks\\\" and \\\"Disable for Wi-Fi networks\\\" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.\"}], \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}, {\"capecId\": \"CAPEC-554\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-554 Functionality Bypass\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"LOW\", \"baseScore\": 6.7, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"a22f1246-ba21-4bb4-a601-ad51614c1513\", \"shortName\": \"cloudflare\", \"dateUpdated\": \"2022-10-28T09:24:40.799Z\"}, \"references\": [{\"url\": \"https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Upgrade to specified patched versions.\u003cbr\u003e\"}], \"value\": \"Upgrade to specified patched versions.\\n\"}], \"source\": {\"advisory\": \"GHSA-4463-5p9m-3c78\", \"discovery\": \"EXTERNAL\"}, \"title\": \"Lock WARP switch feature bypass on WARP mobile client for iOS\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:07:06.458Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-3321\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-08T19:15:19.020466Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-08T19:15:24.148Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-3321\", \"assignerOrgId\": \"a22f1246-ba21-4bb4-a601-ad51614c1513\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"cloudflare\", \"requesterUserId\": \"25b7b156-39bf-4f6b-8c25-8bc69c5c5e82\", \"dateReserved\": \"2022-09-26T16:41:00.464Z\", \"datePublished\": \"2022-10-28T09:24:40.799Z\", \"dateUpdated\": \"2025-05-08T19:15:29.857Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.