This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.
This issue affects binwalk from 2.1.2b through 2.3.3 included.
"}],"value":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see https://github.com/ReFirmLabs/binwalk/pull/617)."}],"value":"The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 )."}],"impacts":[{"capecId":"CAPEC-549","descriptions":[{"lang":"en","value":"CAPEC-549 Local Execution of Code"}]},{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"2d533b80-6e4a-4e20-93e2-171235122846","shortName":"ONEKEY","dateUpdated":"2023-09-17T08:07:04.222Z"},"references":[{"url":"https://github.com/ReFirmLabs/binwalk/pull/617"},{"url":"https://security.gentoo.org/glsa/202309-07"}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2022-10-26T07:51:00.000Z","value":"Reported to binwalk maintainers with a pull request containing the fix (https://github.com/ReFirmLabs/binwalk/pull/617)"},{"lang":"en","time":"2023-01-23T08:00:00.000Z","value":"Reported to MSRC since they acquired Refirm Labs and we've observed the CPE 'microsoft:binwalk' for CVE-2021-4287"},{"lang":"en","time":"2023-01-25T08:00:00.000Z","value":"MSRC answers they do not consider binwalk a Microsoft product."}],"title":"Path Traversal in binwalk","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following workaround would fix the vulnerability: