title: Path Traversal in binwalk
description:
A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.
This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.
This issue affects binwalk from 2.1.2b through 2.3.3 included.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unaffected
modules: PFS extractor
packageName: binwalk
platforms: [Linux, MacOS]
product: binwalk
programFiles: https://github.com/ReFirmLabs/binwalk/blob/11a9bcd4451c4e5ff5db5abbc0df06e7b8838568/src/binwalk/plugins/unpfs.py
repo: https://github.com/ReFirmLabs/binwalk/
vendor: Refirm Labs
versions:
lessThanOrEqual: 2.3.3, status: affected, version: 2.1.2b, versionType: 2.1.2b
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 ).
workarounds: The following workaround would fix the vulnerability:
*  removing the unpfs extractor from your local install of binwalk
*  disabling the unpfs extractor by editing binwalk's extract.conf configuration file
*  apply the fix provided at  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617