cvelistv5 - CVE-2022-4510

CVE-2022-4510 (GCVE-0-2022-4510)

Vulnerability from cvelistv5 – Published: 2023-01-25 12:25 – Updated: 2025-03-27 19:55

Summary

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through 2.3.3 included.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

ONEKEY

References

URL

Tags

	https://github.com/ReFirmLabs/binwalk/pull/617
	https://security.gentoo.org/glsa/202309-07

Impacted products

	Vendor	Product	Version
	Refirm Labs	binwalk	Affected: 2.1.2b , ≤ 2.3.3 (2.1.2b)

Credits

Quentin Kaiser from ONEKEY Research Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:41:45.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-07"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-4510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T19:54:52.860514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T19:55:06.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "PFS extractor"
          ],
          "packageName": "binwalk",
          "platforms": [
            "Linux",
            "MacOS"
          ],
          "product": "binwalk",
          "programFiles": [
            "https://github.com/ReFirmLabs/binwalk/blob/11a9bcd4451c4e5ff5db5abbc0df06e7b8838568/src/binwalk/plugins/unpfs.py"
          ],
          "repo": "https://github.com/ReFirmLabs/binwalk/",
          "vendor": "Refirm Labs",
          "versions": [
            {
              "lessThanOrEqual": "2.3.3",
              "status": "affected",
              "version": "2.1.2b",
              "versionType": "2.1.2b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Quentin Kaiser from ONEKEY Research Labs"
        }
      ],
      "datePublic": "2023-01-26T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u0026nbsp;would extract a malicious binwalk module into the folder .config/binwalk/plugins.\u003cbr\u003e\u003c/span\u003e\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003esrc/binwalk/plugins/unpfs.py\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects binwalk from 2.1.2b through 2.3.3 included.\u003c/p\u003e"
            }
          ],
          "value": "A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ReFirmLabs/binwalk/pull/617\"\u003ehttps://github.com/ReFirmLabs/binwalk/pull/617\u003c/a\u003e)."
            }
          ],
          "value": "The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 )."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-549",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-549 Local Execution of Code"
            }
          ]
        },
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:07:04.222Z",
        "orgId": "2d533b80-6e4a-4e20-93e2-171235122846",
        "shortName": "ONEKEY"
      },
      "references": [
        {
          "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
        },
        {
          "url": "https://security.gentoo.org/glsa/202309-07"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2022-10-26T07:51:00.000Z",
          "value": "Reported to binwalk maintainers with a pull request containing the fix (https://github.com/ReFirmLabs/binwalk/pull/617)"
        },
        {
          "lang": "en",
          "time": "2023-01-23T08:00:00.000Z",
          "value": "Reported to MSRC since they acquired Refirm Labs and we\u0027ve observed the CPE \u0027microsoft:binwalk\u0027 for CVE-2021-4287"
        },
        {
          "lang": "en",
          "time": "2023-01-25T08:00:00.000Z",
          "value": "MSRC answers they do not consider binwalk a Microsoft product."
        }
      ],
      "title": "Path Traversal in binwalk",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following workaround would fix the vulnerability:\u003cbr\u003e\u003cul\u003e\u003cli\u003eremoving the unpfs extractor from your local install of binwalk\u003c/li\u003e\u003cli\u003edisabling the unpfs extractor by editing binwalk\u0027s extract.conf configuration file\u003c/li\u003e\u003cli\u003eapply the fix provided at\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ReFirmLabs/binwalk/pull/617\"\u003ehttps://github.com/ReFirmLabs/binwalk/pull/617\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "The following workaround would fix the vulnerability:\n  *  removing the unpfs extractor from your local install of binwalk\n  *  disabling the unpfs extractor by editing binwalk\u0027s extract.conf configuration file\n  *  apply the fix provided at\u00a0 https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2d533b80-6e4a-4e20-93e2-171235122846",
    "assignerShortName": "ONEKEY",
    "cveId": "CVE-2022-4510",
    "datePublished": "2023-01-25T12:25:14.811Z",
    "dateReserved": "2022-12-15T08:12:09.055Z",
    "dateUpdated": "2025-03-27T19:55:06.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:binwalk:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.2.0\", \"versionEndExcluding\": \"2.3.3\", \"matchCriteriaId\": \"E0573243-9C2F-4B14-8188-A01F9457D408\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\nA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\\n\\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Se identific\\u00f3 una vulnerabilidad de path traversal en binwalk de ReFirm Labs desde la versi\\u00f3n 2.1.2b hasta la 2.3.3 incluidas. Mediante la creaci\\u00f3n de un archivo de sistema de archivos PFS malicioso, un atacante puede hacer que el extractor PFS de binwalk extraiga archivos en ubicaciones arbitrarias cuando binwalk se ejecuta en modo de extracci\\u00f3n (opci\\u00f3n -e). Se puede lograr la ejecuci\\u00f3n remota de c\\u00f3digo creando un sistema de archivos PFS que, al extraerlo, extraiga un m\\u00f3dulo malicioso de binwalk en la carpeta .config/binwalk/plugins. Esta vulnerabilidad est\\u00e1 asociada a los archivos de programa src/binwalk/plugins/unpfs.py. Este problema afecta a binwalk desde la versi\\u00f3n 2.1.2b hasta la 2.3.3 incluidas.\"}]",
      "id": "CVE-2022-4510",
      "lastModified": "2024-11-21T07:35:24.413",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"research@onekey.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2023-01-26T21:18:06.547",
      "references": "[{\"url\": \"https://github.com/ReFirmLabs/binwalk/pull/617\", \"source\": \"research@onekey.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202309-07\", \"source\": \"research@onekey.com\"}, {\"url\": \"https://github.com/ReFirmLabs/binwalk/pull/617\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202309-07\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "research@onekey.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"research@onekey.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-4510\",\"sourceIdentifier\":\"research@onekey.com\",\"published\":\"2023-01-26T21:18:06.547\",\"lastModified\":\"2025-02-13T17:15:50.957\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\\n\\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\"},{\"lang\":\"es\",\"value\":\"Se identific\u00f3 una vulnerabilidad de path traversal en binwalk de ReFirm Labs desde la versi\u00f3n 2.1.2b hasta la 2.3.3 incluidas. Mediante la creaci\u00f3n de un archivo de sistema de archivos PFS malicioso, un atacante puede hacer que el extractor PFS de binwalk extraiga archivos en ubicaciones arbitrarias cuando binwalk se ejecuta en modo de extracci\u00f3n (opci\u00f3n -e). Se puede lograr la ejecuci\u00f3n remota de c\u00f3digo creando un sistema de archivos PFS que, al extraerlo, extraiga un m\u00f3dulo malicioso de binwalk en la carpeta .config/binwalk/plugins. Esta vulnerabilidad est\u00e1 asociada a los archivos de programa src/binwalk/plugins/unpfs.py. Este problema afecta a binwalk desde la versi\u00f3n 2.1.2b hasta la 2.3.3 incluidas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"research@onekey.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"research@onekey.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:binwalk:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.2.0\",\"versionEndExcluding\":\"2.3.3\",\"matchCriteriaId\":\"E0573243-9C2F-4B14-8188-A01F9457D408\"}]}]}],\"references\":[{\"url\":\"https://github.com/ReFirmLabs/binwalk/pull/617\",\"source\":\"research@onekey.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202309-07\",\"source\":\"research@onekey.com\"},{\"url\":\"https://github.com/ReFirmLabs/binwalk/pull/617\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202309-07\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/ReFirmLabs/binwalk/pull/617\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202309-07\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:41:45.526Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-4510\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-27T19:54:52.860514Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-27T19:54:58.463Z\"}}], \"cna\": {\"title\": \"Path Traversal in binwalk\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Quentin Kaiser from ONEKEY Research Labs\"}], \"impacts\": [{\"capecId\": \"CAPEC-549\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-549 Local Execution of Code\"}]}, {\"capecId\": \"CAPEC-126\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-126 Path Traversal\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/ReFirmLabs/binwalk/\", \"vendor\": \"Refirm Labs\", \"modules\": [\"PFS extractor\"], \"product\": \"binwalk\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.1.2b\", \"versionType\": \"2.1.2b\", \"lessThanOrEqual\": \"2.3.3\"}], \"platforms\": [\"Linux\", \"MacOS\"], \"packageName\": \"binwalk\", \"programFiles\": [\"https://github.com/ReFirmLabs/binwalk/blob/11a9bcd4451c4e5ff5db5abbc0df06e7b8838568/src/binwalk/plugins/unpfs.py\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 ).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/ReFirmLabs/binwalk/pull/617\\\"\u003ehttps://github.com/ReFirmLabs/binwalk/pull/617\u003c/a\u003e).\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-10-26T07:51:00.000Z\", \"value\": \"Reported to binwalk maintainers with a pull request containing the fix (https://github.com/ReFirmLabs/binwalk/pull/617)\"}, {\"lang\": \"en\", \"time\": \"2023-01-23T08:00:00.000Z\", \"value\": \"Reported to MSRC since they acquired Refirm Labs and we\u0027ve observed the CPE \u0027microsoft:binwalk\u0027 for CVE-2021-4287\"}, {\"lang\": \"en\", \"time\": \"2023-01-25T08:00:00.000Z\", \"value\": \"MSRC answers they do not consider binwalk a Microsoft product.\"}], \"datePublic\": \"2023-01-26T09:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/ReFirmLabs/binwalk/pull/617\"}, {\"url\": \"https://security.gentoo.org/glsa/202309-07\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"The following workaround would fix the vulnerability:\\n  *  removing the unpfs extractor from your local install of binwalk\\n  *  disabling the unpfs extractor by editing binwalk\u0027s extract.conf configuration file\\n  *  apply the fix provided at\\u00a0 https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The following workaround would fix the vulnerability:\u003cbr\u003e\u003cul\u003e\u003cli\u003eremoving the unpfs extractor from your local install of binwalk\u003c/li\u003e\u003cli\u003edisabling the unpfs extractor by editing binwalk\u0027s extract.conf configuration file\u003c/li\u003e\u003cli\u003eapply the fix provided at\u0026nbsp;\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/ReFirmLabs/binwalk/pull/617\\\"\u003ehttps://github.com/ReFirmLabs/binwalk/pull/617\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\\n\\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u0026nbsp;would extract a malicious binwalk module into the folder .config/binwalk/plugins.\u003cbr\u003e\u003c/span\u003e\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003esrc/binwalk/plugins/unpfs.py\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects binwalk from 2.1.2b through 2.3.3 included.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"2d533b80-6e4a-4e20-93e2-171235122846\", \"shortName\": \"ONEKEY\", \"dateUpdated\": \"2023-09-17T08:07:04.222Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-4510\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-27T19:55:06.184Z\", \"dateReserved\": \"2022-12-15T08:12:09.055Z\", \"assignerOrgId\": \"2d533b80-6e4a-4e20-93e2-171235122846\", \"datePublished\": \"2023-01-25T12:25:14.811Z\", \"assignerShortName\": \"ONEKEY\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2022-4510

Vulnerability from fkie_nvd - Published: 2023-01-26 21:18 - Updated: 2025-02-13 17:15

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
research@onekey.com	https://github.com/ReFirmLabs/binwalk/pull/617	Exploit, Patch, Third Party Advisory
research@onekey.com	https://security.gentoo.org/glsa/202309-07
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ReFirmLabs/binwalk/pull/617	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/202309-07

Impacted products

	Vendor	Product	Version
	microsoft	binwalk	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:binwalk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0573243-9C2F-4B14-8188-A01F9457D408",
              "versionEndExcluding": "2.3.3",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included."
    },
    {
      "lang": "es",
      "value": "Se identific\u00f3 una vulnerabilidad de path traversal en binwalk de ReFirm Labs desde la versi\u00f3n 2.1.2b hasta la 2.3.3 incluidas. Mediante la creaci\u00f3n de un archivo de sistema de archivos PFS malicioso, un atacante puede hacer que el extractor PFS de binwalk extraiga archivos en ubicaciones arbitrarias cuando binwalk se ejecuta en modo de extracci\u00f3n (opci\u00f3n -e). Se puede lograr la ejecuci\u00f3n remota de c\u00f3digo creando un sistema de archivos PFS que, al extraerlo, extraiga un m\u00f3dulo malicioso de binwalk en la carpeta .config/binwalk/plugins. Esta vulnerabilidad est\u00e1 asociada a los archivos de programa src/binwalk/plugins/unpfs.py. Este problema afecta a binwalk desde la versi\u00f3n 2.1.2b hasta la 2.3.3 incluidas."
    }
  ],
  "id": "CVE-2022-4510",
  "lastModified": "2025-02-13T17:15:50.957",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "research@onekey.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-01-26T21:18:06.547",
  "references": [
    {
      "source": "research@onekey.com",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
    },
    {
      "source": "research@onekey.com",
      "url": "https://security.gentoo.org/glsa/202309-07"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202309-07"
    }
  ],
  "sourceIdentifier": "research@onekey.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "research@onekey.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

OPENSUSE-SU-2024:12649-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

binwalk-2.3.3-2.1 on GA media

Notes

Title of the patch

binwalk-2.3.3-2.1 on GA media

Description of the patch

These are all security issues fixed in the binwalk-2.3.3-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-12649

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "binwalk-2.3.3-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the binwalk-2.3.3-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-12649",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12649-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-4510 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-4510/"
      }
    ],
    "title": "binwalk-2.3.3-2.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:12649-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binwalk-2.3.3-2.1.aarch64",
                "product": {
                  "name": "binwalk-2.3.3-2.1.aarch64",
                  "product_id": "binwalk-2.3.3-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binwalk-2.3.3-2.1.ppc64le",
                "product": {
                  "name": "binwalk-2.3.3-2.1.ppc64le",
                  "product_id": "binwalk-2.3.3-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binwalk-2.3.3-2.1.s390x",
                "product": {
                  "name": "binwalk-2.3.3-2.1.s390x",
                  "product_id": "binwalk-2.3.3-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binwalk-2.3.3-2.1.x86_64",
                "product": {
                  "name": "binwalk-2.3.3-2.1.x86_64",
                  "product_id": "binwalk-2.3.3-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binwalk-2.3.3-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:binwalk-2.3.3-2.1.aarch64"
        },
        "product_reference": "binwalk-2.3.3-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binwalk-2.3.3-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:binwalk-2.3.3-2.1.ppc64le"
        },
        "product_reference": "binwalk-2.3.3-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binwalk-2.3.3-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:binwalk-2.3.3-2.1.s390x"
        },
        "product_reference": "binwalk-2.3.3-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binwalk-2.3.3-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:binwalk-2.3.3-2.1.x86_64"
        },
        "product_reference": "binwalk-2.3.3-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4510",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-4510"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "\nA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,  would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\n\n",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:binwalk-2.3.3-2.1.aarch64",
          "openSUSE Tumbleweed:binwalk-2.3.3-2.1.ppc64le",
          "openSUSE Tumbleweed:binwalk-2.3.3-2.1.s390x",
          "openSUSE Tumbleweed:binwalk-2.3.3-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-4510",
          "url": "https://www.suse.com/security/cve/CVE-2022-4510"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207744 for CVE-2022-4510",
          "url": "https://bugzilla.suse.com/1207744"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.aarch64",
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.ppc64le",
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.s390x",
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.aarch64",
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.ppc64le",
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.s390x",
            "openSUSE Tumbleweed:binwalk-2.3.3-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-4510"
    }
  ]
}

GSD-2022-4510

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-4510

Aliases

CVE-2022-4510

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-4510",
    "description": "A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.2 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through 2.3.3 included.",
    "id": "GSD-2022-4510",
    "references": [
      "https://advisories.mageia.org/CVE-2022-4510.html",
      "https://www.suse.com/security/cve/CVE-2022-4510.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-4510"
      ],
      "details": "\nA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\n\n",
      "id": "GSD-2022-4510",
      "modified": "2023-12-13T01:19:15.715369Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "research@onekey.com",
        "ID": "CVE-2022-4510",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "binwalk",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "2.1.2b",
                          "version_value": "2.3.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Refirm Labs"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Quentin Kaiser from ONEKEY Research Labs"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "\nA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\n\n"
          }
        ]
      },
      "exploit": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ReFirmLabs/binwalk/pull/617\"\u003ehttps://github.com/ReFirmLabs/binwalk/pull/617\u003c/a\u003e)."
            }
          ],
          "value": "The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 )."
        }
      ],
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-22",
                "lang": "eng",
                "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ReFirmLabs/binwalk/pull/617",
            "refsource": "MISC",
            "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
          },
          {
            "name": "https://security.gentoo.org/glsa/202309-07",
            "refsource": "MISC",
            "url": "https://security.gentoo.org/glsa/202309-07"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      },
      "work_around": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following workaround would fix the vulnerability:\u003cbr\u003e\u003cul\u003e\u003cli\u003eremoving the unpfs extractor from your local install of binwalk\u003c/li\u003e\u003cli\u003edisabling the unpfs extractor by editing binwalk\u0027s extract.conf configuration file\u003c/li\u003e\u003cli\u003eapply the fix provided at\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ReFirmLabs/binwalk/pull/617\"\u003ehttps://github.com/ReFirmLabs/binwalk/pull/617\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "The following workaround would fix the vulnerability:\n  *  removing the unpfs extractor from your local install of binwalk\n  *  disabling the unpfs extractor by editing binwalk\u0027s extract.conf configuration file\n  *  apply the fix provided at\u00a0 https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 \n\n\n"
        }
      ]
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.1.2b,\u003c=2.3.3",
          "affected_versions": "All versions starting from 2.1.2b up to 2.3.3",
          "cwe_ids": [
            "CWE-1035",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2023-02-04",
          "description": "A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through 2.3.3 included.",
          "fixed_versions": [],
          "identifier": "CVE-2022-4510",
          "identifiers": [
            "GHSA-3cm8-v4mc-gppg",
            "CVE-2022-4510"
          ],
          "not_impacted": "",
          "package_slug": "pypi/binwalk",
          "pubdate": "2023-01-26",
          "solution": "Unfortunately, there is no solution available yet.",
          "title": "Relative Path Traversal",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-4510",
            "https://github.com/ReFirmLabs/binwalk/pull/617",
            "https://github.com/advisories/GHSA-3cm8-v4mc-gppg"
          ],
          "uuid": "bd067a27-8fb4-4922-9377-b88552896360"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:binwalk:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.3.3",
                "versionStartIncluding": "2.2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "research@onekey.com",
          "ID": "CVE-2022-4510"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "\nA path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.\n\n"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ReFirmLabs/binwalk/pull/617",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
            },
            {
              "name": "https://security.gentoo.org/glsa/202309-07",
              "refsource": "MISC",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/202309-07"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-09-17T09:15Z",
      "publishedDate": "2023-01-26T21:18Z"
    }
  }
}

GHSA-3CM8-V4MC-GPPG

Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2023-09-20 21:09

Summary

Path traversal in binwalk

Details

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.

Severity ?

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "binwalk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.2b"
            },
            {
              "last_affected": "2.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-4510"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-31T20:53:49Z",
    "nvd_published_at": "2023-01-26T21:18:00Z",
    "severity": "HIGH"
  },
  "details": "A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk\u0027s PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.",
  "id": "GHSA-3cm8-v4mc-gppg",
  "modified": "2023-09-20T21:09:18Z",
  "published": "2023-01-26T21:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4510"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ReFirmLabs/binwalk/pull/617"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ReFirmLabs/binwalk"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202309-07"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Path traversal in binwalk"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-4510 (GCVE-0-2022-4510)

FKIE_CVE-2022-4510

OPENSUSE-SU-2024:12649-1

GSD-2022-4510

GHSA-3CM8-V4MC-GPPG

Tags

Sightings

Nomenclature