CVE-2025-0651

Executive Summary

CVE-2025-0655 is a high-severity improper privilege management vulnerability in Cloudflare WARP for Windows. A low-privileged user can create symbolic links (symlinks) within the C:/ProgramData/Cloudflare/warp-diag-partials folder. When the "Reset all settings" option is triggered, the WARP service—running with SYSTEM privileges—deletes the files pointed to by these symlinks. This allows an attacker to delete arbitrary files owned by the SYSTEM user, potentially causing denial of service, data loss, or system instability.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a native Windows application issue. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions beyond user access.
• Privileges Required (PR): Low (L) – Attacker needs only low system privileges.
• User Interaction (UI): Required (R) – Victim must trigger "Reset all settings".
• Scope (S): Unchanged (U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact (C): None (N) – No data exposure.
• Integrity Impact (I): High (H) – Arbitrary file deletion.
• Availability Impact (A): High (H) – Can delete critical system files.

CVSS Score: 7.1 (High)
Threat Level: High – Exploitation requires low privileges and user interaction, but impact is severe.

Deep Dive & Mechanics

The vulnerability resides in the WARP service's handling of the "Reset all settings" operation. The service recursively deletes the contents of C:/ProgramData/Cloudflare/warp-diag-partials without verifying that the files are legitimate. A low-privileged user can create symlinks in this directory pointing to arbitrary system files (e.g., C:/Windows/System32/config/SAM). When the service deletes the symlink targets, it effectively deletes the system files.

Attack Flow:

1. Attacker gains low-privileged access to the Windows system.
2. Attacker creates a symlink in C:/ProgramData/Cloudflare/warp-diag-partials pointing to a critical system file (e.g., C:/Windows/System32/drivers/etc/hosts).
3. Attacker waits for or social engineers an administrator to trigger "Reset all settings" in WARP.
4. WARP service (SYSTEM) deletes the symlink target, causing system disruption.

Root Cause: Lack of symlink validation and improper privilege management during file deletion operations.

Vulnerable vs. Patched Code

Vulnerable Code (WARP < 2024.12.492.0):

// Pseudocode for vulnerable deletion
void ResetAllSettings() {
    string diagPath = @"C:\ProgramData\Cloudflare\warp-diag-partials";
    foreach (string file in Directory.GetFiles(diagPath)) {
        File.Delete(file); // Deletes symlink target without validation
    }
}

Patched Code (WARP >= 2024.12.492.0):

// Pseudocode for patched deletion
void ResetAllSettings() {
    string diagPath = @"C:\ProgramData\Cloudflare\warp-diag-partials";
    foreach (string file in Directory.GetFiles(diagPath)) {
        if (!IsSymlink(file)) {
            File.Delete(file);
        } else {
            LogWarning("Symlink detected and skipped: " + file);
        }
    }
}

bool IsSymlink(string path) {
    // Uses Windows API to check for reparse points
    return (File.GetAttributes(path) & FileAttributes.ReparsePoint) != 0;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows 10/11 with WARP < 2024.12.492.0 installed.
• Low-privileged user account (e.g., User).

Steps:

1. Open Command Prompt as low-privileged user.
2. Create a symlink to a non-critical test file (e.g., C:\temp\test.txt):

   mklink "C:\ProgramData\Cloudflare\warp-diag-partials\evil_link" "C:\temp\test.txt"
   

3. Trigger "Reset all settings" via WARP GUI or CLI:

   "C:\Program Files\Cloudflare\Cloudflare WARP\warp-cli.exe" reset-settings
   

4. Verify deletion of C:\temp\test.txt.

For destructive impact (demonstration only):

mklink "C:\ProgramData\Cloudflare\warp-diag-partials\evil_link" "C:\Windows\System32\drivers\etc\hosts"

Blue Team (Detection & Prevention)

Detection:

• Monitor for creation of symlinks in C:\ProgramData\Cloudflare\warp-diag-partials\ by non-SYSTEM processes.
• Alert on File.Delete operations targeting system-protected paths.

Prevention:

• Restrict write access to C:\ProgramData\Cloudflare\warp-diag-partials\ to only SYSTEM and Administrators.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block symlink creation from untrusted sources.

Indicators of Compromise (IOCs)

• File Path: C:\ProgramData\Cloudflare\warp-diag-partials\*.lnk (symlinks)
• Process: warp-svc.exe performing unexpected file deletions
• Event ID: 4663 (Windows Security Audit) – File deletion by warp-svc.exe on non-WARP paths
• Registry: HKLM\SOFTWARE\Cloudflare\WARP\ResetSettings (triggered)

Detection Engineering

YARA Rule

rule CVE_2025_0655_Symlink_Detection {
    meta:
        description = "Detects symlink creation in Cloudflare WARP diag folder"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-0655"
    strings:
        $s1 = "C:\\ProgramData\\Cloudflare\\warp-diag-partials" nocase
        $s2 = "mklink" nocase
        $s3 = "symlink" nocase
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: CVE-2025-0655 - Symlink Creation in WARP Diag Folder
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects creation of symlinks in the Cloudflare WARP diagnostics folder
author: Valters IT
date: 2025/02/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0655
logsource:
    product: windows
    service: security
    category: file_event
detection:
    selection:
        TargetFilename|startswith: 'C:\ProgramData\Cloudflare\warp-diag-partials\'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Legitimate WARP operations (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0655 - WARP Symlink Exploit Attempt"; flow:to_server,established; content:"mklink"; nocase; content:"warp-diag-partials"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade WARP to version 2024.12.492.0 or later.
2. Restrict write permissions on C:\ProgramData\Cloudflare\warp-diag-partials\ to only SYSTEM and Administrators.

Long-term:

• Implement symlink validation in all file deletion routines.
• Use Windows Integrity Mechanism to prevent low-integrity processes from creating symlinks in high-integrity directories.
• Enable Windows Defender ASR rule: "Block Office applications from creating child processes" and "Block executable files from running unless they meet a prevalence, age, or trusted list criterion."

Workaround:

• Disable "Reset all settings" functionality via Group Policy if upgrade is not immediately possible.

Valters IT