Fehlerhafte Symlink-Verwendung könnte zum Löschen von Dateien des SYSTEM-Benutzers führen

The core impact of CVE-2025-0651 lies in the potential for unauthorized file deletion. An attacker, even with limited system privileges, can craft a sequence of actions to exploit this vulnerability. First, they create symbolic links within the designated WARP diagnostic directory. Subsequently, by initiating the 'Reset all settings' process, the WARP service, running with elevated System privileges, will attempt to delete files pointed to by these malicious symlinks. This could result in the accidental deletion of critical system files, leading to instability, data loss, or even a complete system failure. The blast radius is significant, as the deletion of core system files can have widespread consequences.

Organizations and individuals using Cloudflare WARP on Windows are at risk. This includes users who have not yet updated to the latest version and those with legacy configurations that might be more susceptible to exploitation. Shared hosting environments where multiple users have access to the system are also at increased risk.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*WARP*'} | Select-Object TaskName, State

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*warp*'} | Select-Object ProcessName, Id

• windows / supply-chain: Check the registry for unusual entries under HKEYCURRENTUSER\Software\Cloudflare\WARP or HKEYLOCALMACHINE\Software\Cloudflare\WARP that might indicate malicious configuration. • windows / supply-chain: Use Windows Defender to search for suspicious processes or files related to WARP, particularly those creating symbolic links in the C:\ProgramData\Cloudflare\warp-diag-partials directory.

1. 2025-01-22Disclosure

   disclosure

1. Reserviert2025-01-22
2. Veröffentlicht2025-01-22
3. Geändert2025-02-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-0651 is to immediately upgrade Cloudflare WARP to version 2024.12.492.0 or later. While a direct workaround is not available, restricting access to the C:\ProgramData\Cloudflare\warp-diag-partials directory could offer a temporary layer of defense, though this is not a substitute for patching. Monitor system logs for unusual file deletion activity, particularly within the WARP diagnostic directory. Consider implementing stricter access controls on the C:\ProgramData directory to limit the ability of low-privilege users to create symbolic links. After upgrading, confirm the fix by attempting to create and delete files via symlinks within the WARP diagnostic directory to ensure the intended behavior is restored.