CVE-2023-43115 – This vulnerability in Artifex Ghostscript allow... (How to Fix)

Q: What is the severity of CVE-2023-43115?

CVE-2023-43115 has a CVSS score of 8.8 (HIGH). This vulnerability in Artifex Ghostscript allows remote code execution via specially crafted PostScript documents. Attackers can bypass SAFER restrictions by switching to the IJS device or modifying IjsServer parameters after SAFER activation. Systems processing untrusted PostScript files with Ghostscript versions through 10.01.2 are affected.

📋 TL;DR

This vulnerability in Artifex Ghostscript allows remote code execution via specially crafted PostScript documents. Attackers can bypass SAFER restrictions by switching to the IJS device or modifying IjsServer parameters after SAFER activation. Systems processing untrusted PostScript files with Ghostscript versions through 10.01.2 are affected.

💻 Affected Systems

Products:

Artifex Ghostscript
GhostPDL

Versions: Through 10.01.2

Operating Systems: Linux, Windows, macOS, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Any system using Ghostscript to process PostScript, PDF, or other supported formats from untrusted sources is vulnerable. This includes document processing systems, print servers, and web applications converting document formats.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with attacker gaining the same privileges as the Ghostscript process, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.

🟠

Likely Case

Remote code execution on systems processing malicious PostScript files, allowing attackers to execute arbitrary commands, install malware, or pivot to other systems.

🟢

If Mitigated

Limited impact if Ghostscript runs with minimal privileges, in sandboxed environments, or only processes trusted documents.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires delivering a malicious PostScript document to a vulnerable system. The vulnerability bypasses SAFER restrictions that should prevent command execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 10.02.0 and later

Vendor Advisory: https://ghostscript.com/

Restart Required: No

Instructions:

1. Download Ghostscript 10.02.0 or later from https://ghostscript.com/releases/. 2. Follow installation instructions for your platform. 3. Replace existing Ghostscript binaries with patched versions. 4. Test document processing functionality.

🔧 Temporary Workarounds

Disable IJS device

all

Prevent Ghostscript from using the IJS device by removing or restricting access to IJS-related configuration.

gs -dSAFER -dNODISPLAY -c 'quit' 2>&1 | grep -i ijs

Run with minimal privileges

linux

Execute Ghostscript with restricted user permissions to limit potential damage from exploitation.

sudo -u nobody gs [options]

🧯 If You Can't Patch

Implement strict input validation to reject suspicious PostScript documents
Run Ghostscript in containerized or sandboxed environments with network restrictions

🔍 How to Verify

Check if Vulnerable:

Check Ghostscript version: gs --version. If version is 10.01.2 or earlier, system is vulnerable.

Check Version:

gs --version

Verify Fix Applied:

After patching, verify version is 10.02.0 or later: gs --version

📡 Detection & Monitoring

Log Indicators:

Unusual Ghostscript process spawning child processes
IJS device activation in Ghostscript logs
Multiple failed document processing attempts

Network Indicators:

Unexpected outbound connections from Ghostscript processes
Network traffic to unusual ports from document processing systems

SIEM Query:

process_name:"gs" AND (child_process_count > 2 OR command_line:"ijs")

📊 Metadata

CVE ID: CVE-2023-43115

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published: September 18, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON