CVE-2022-4510

Name of the Vulnerable Software and Affected Versions binwalk versions 2.1.2b through 2.3.3

Description binwalk is susceptible to a path traversal vulnerability. An attacker can exploit this by crafting a malicious PFS filesystem file, which allows them to extract files to arbitrary locations when binwalk is run in extraction mode (using the -e option). This can lead to remote code execution by extracting a malicious binwalk module into the .config/binwalk/plugins folder. The vulnerability is associated with the src/binwalk/plugins/unpfs.py file.

Recommendations Upgrade to a version of binwalk newer than 2.3.3.