PT-2023-14727 · Sleuth Kit · Sleuthkit

Dino Barlattani + 1 · Published 2023-01-24 · Updated 2024-08-03 · CVE-2022-45639

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sleuthkit fls tool version 4.11.1

Description The issue allows attackers to execute arbitrary commands via a crafted value to the m parameter. This is an OS Command injection vulnerability. Note that there is a dispute regarding the impact of this issue, as some parties claim that the backtick command does not execute outside the context of the user account that entered the command line.

Recommendations For sleuthkit fls tool version 4.11.1, consider restricting the use of the m parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using crafted values for the m parameter. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2023-1421

CVE-2022-45639

Affected Products

Sleuthkit

References · 12

• 🔥 https://exploit-db.com/exploits/51225 · Exploit
• 🔥 http://binaryworld.it · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45639 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45639 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45639 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1421 · Vendor Advisory
• https://t.me/cibsecurity/56887 · Telegram Post
• https://t.me/cvenotify/43190 · Telegram Post
• https://binaryworld.it/guidepoc.asp#CVE-2022-45639 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2022-45639 · Note
• https://t.me/cvenotify/88794 · Telegram Post
• http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html · Note