Qkaiser

The issue is related to path traversal when running against specifically crafted UBIFS files, allowing an attacker to overwrite files outside of the extraction directory if the process has write access. This occurs because a node name (`dent node.name`) is considered trusted and joined to the extraction directory path during processing, and then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g., ../../tmp/outside.txt), it's possible to force the software to write outside of the extraction directory.

binwalk is susceptible to a path traversal vulnerability. An attacker can exploit this by crafting a malicious PFS filesystem file, which allows them to extract files to arbitrary locations when binwalk is run in extraction mode (using the -e option). This can lead to remote code execution by extracting a malicious binwalk module into the `.config/binwalk/plugins` folder. The vulnerability is associated with the `src/binwalk/plugins/unpfs.py` file.

A vulnerability has been found in the UBIFS File Handler component, specifically affecting the `ubireader extract files` function of the file `ubireader/ubifs/output.py`. This issue leads to path traversal and can be exploited remotely.

The issue allows remote attackers to read and delete arbitrary files. This is achieved via the `tmpfname` parameter to API endpoints such as "log mgt adhocquery ajaxhandler.php", "log mgt ajaxhandler.php", or the `tf` parameter to "wcs bwlists handler.php".

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain parameters. This can be done through the `host` or `apikey` parameter in a register action, the `enable` parameter in a save stting action, or the `host` or `apikey` parameter in a test connection action.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `password` to "api/v1/cfg/oauth/save identify pfx/".

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `spare Community`, `spare AllowGroupIP`, or `spare AllowGroupNetmask` parameter to "admin notification.php" API endpoint.

The issue allows local web server users to execute arbitrary code with root privileges. This can be achieved by using a Trojan horse .war file in the Solr webapps directory.