Path Traversal in binwalk
46Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 7.8epss 22%
da publicação à arma12 dias
Publicada no NVD25 de jan.
1ª PoC+12d
probabilidade de exploração
22%top 3% das CVEs
exploração observada
nãonenhuma fonte reporta
4 exploit(s) público(s)
A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.
This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.
This issue affects binwalk from 2.1.2b through 2.3.3 included.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Refirm Labs · binwalkPoCs públicas encontradas — 4
exploitdbwww.exploit-db.com/exploits/51249não verificadogithubgithub.com/adhikara13/CVE-2022-4510-WalkingPath★ 14githubgithub.com/electr0sm0g/CVE-2022-4510★ 9githubgithub.com/Kalagious/BadPfs-CVE-2022-4510★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.