CVE-2023-2754


Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device.


We have discovered 180 live websites that are affected by CVE-2023-2754.

Contact us to get more info



Affected Software

Product  Warp
Category Web Servers
Vulnerable Versions
  • from 0 before 2023.7.160
Total Vulnerable Versions38
Vulnerable Domains180 live websites (100.00% of Warp install base)


Common Weakness Enumeration


CWE-319 Cleartext Transmission of Sensitive Information


Distribution by Website Rank

The diagram provides a graphic representation of the correlation between the occurrence of CVE-2023-2754 and the relative popularity of websites


Details

  • Published - Aug 3, 2023
  • Updated - Aug 3, 2023

Credits

  • vanhoefm (reporter)





Countries

United States79 websites


Germany50 websites
France11 websites
GB6 websites
Singapore5 websites
Sweden4 websites
Australia3 websites
2 websites
Canada2 websites
Switzerland2 websites

TLDs

.com67 websites
.de27 websites
.net18 websites
.org14 websites
.io9 websites
.se4 websites
.fr4 websites
.ch2 websites
.co.uk2 websites
.info2 websites

Vulnerable Versions

Vulnerable versions are highlighted in red


Geographical Distribution

The distribution of websites across the globe that are exposed to CVE-2023-2754 through included software libraries and plugins.



References


Websites affected by CVE-2023-2754

Top websites that are affected by CVE-2023-2754. Please click on the "Contact us" button above to get more information.
DomainCountryRankContacts
*********.coop United States***,***
*.****.com United States***,***
***.**********.com United States***,***
**********************.org GB***,***
**************.se Sweden*,***,***
***.*************.com Germany*,***,***
***.***********.com United States*,***,***
*********.org United States*,***,***
*******.de Germany*,***,***
****.*********.io France*,***,***
See full domain list