High severity · published Jan 24, 2023
CVE-2022-45639
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter
7.8
CVSS
4.7%
EPSS
No
On KEV
Description
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
The Sleuth Kit · Sleuthkit
4.11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45639
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45639
packetstormsecurity.com
http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html
Exploit
http://www.binaryworld.it/
Broken Link
https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
More from The Sleuth Kit
9.8
CVE-2020-10232
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c
9.8
CVE-2019-14532
An issue was discovered in The Sleuth Kit (TSK) 4.6.6
9.8
CVE-2019-14531
An issue was discovered in The Sleuth Kit (TSK) 4.6.6
9.1
CVE-2020-10233
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c
8.1
CVE-2018-11740
An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1