Parseusbs OS Command Injection Vulnerability via Crafted LNK Filenames

A command injection vulnerability has been identified in parseusbs versions prior to 1.9. The issue arises in the parseUSBs.py file, where LNK file paths are passed into an os.popen() shell command without proper sanitization. This flaw allows for arbitrary command execution on the forensic examiner's machine by embedding shell metacharacters in .lnk filenames. The vulnerability is exploited during the parsing of USB artifacts.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected machine.

Reproduction

To reproduce this vulnerability, create a .lnk file with a path that includes shell metacharacters. When this .lnk file is processed by parseusbs, the embedded commands will be executed on the machine running the tool.

Remediation

Users can update to parseusbs version 1.9 or later, where this vulnerability has been fixed.