Executive brief
binwalk is a popular firmware analysis and extraction tool used by security researchers and embedded systems developers. A path traversal vulnerability in its PFS filesystem extractor allows attackers to write files to arbitrary locations on a system when processing a malicious PFS filesystem image. An attacker can exploit this to achieve remote code execution by injecting a malicious plugin that gets loaded when binwalk runs.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the PFS extractor plugin (src/binwalk/plugins/unpfs.py) that affects binwalk versions 2.1.2b through 2.3.3. The root cause is improper use of os.path.join without path resolution—it fails to fully normalize paths containing traversal sequences like "..". An attacker can craft a malicious PFS filesystem file that, when processed by binwalk in extraction mode (-e flag), causes the extractor to write files outside the intended extraction directory. By extracting a malicious plugin into ~/.config/binwalk/plugins, the attacker achieves remote code execution when binwalk loads and executes the plugin. The vulnerability requires local access and user interaction (running binwalk on a crafted file), and has been patched as of version 2.3.4 (PR #617).
Affected products
- ReFirm Labs binwalk 2.1.2b through 2.3.3
Timeline
- 2023-01-26: disclosed
- 2023-02-01: patched: PR #617 merged fixing path traversal in PFS extractor