CVE-2024-33870
📋 TL;DR
This vulnerability in Ghostscript allows path traversal attacks via crafted PostScript documents, enabling unauthorized file access when the current directory is in permitted paths. It affects systems using vulnerable Ghostscript versions for document processing, particularly those handling untrusted PostScript files.
💻 Affected Systems
- Artifex Ghostscript
📦 What is this software?
Ghostscript by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, potentially leading to information disclosure, privilege escalation, or further exploitation.
Likely Case
Unauthorized access to files within permitted directories, potentially exposing configuration files, credentials, or other sensitive data.
If Mitigated
Limited impact with proper file permissions and restricted permitted paths, potentially only accessing non-sensitive files.
🎯 Exploit Status
Exploitation requires crafting a malicious PostScript document and having it processed by vulnerable Ghostscript with appropriate directory permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.03.1
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=707686
Restart Required: No
Instructions:
1. Download Ghostscript 10.03.1 or later from official sources. 2. Replace existing Ghostscript installation with patched version. 3. Verify installation with 'gs --version'.
🔧 Temporary Workarounds
Restrict Permitted Paths
allLimit Ghostscript's permitted paths to prevent traversal outside intended directories.
Configure -sSAFER mode with restricted -I paths in Ghostscript usage
Disable PostScript Processing
allPrevent processing of PostScript files if not required for workflow.
Remove or disable Ghostscript PostScript handlers in applications
🧯 If You Can't Patch
- Implement strict input validation to reject PostScript files with path traversal sequences.
- Run Ghostscript in sandboxed environments with minimal file system access.
🔍 How to Verify
Check if Vulnerable:
Check Ghostscript version with 'gs --version' and compare to 10.03.1.Check Version:
gs --versionVerify Fix Applied:
Confirm version is 10.03.1 or later with 'gs --version' and test with known safe PostScript files.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Ghostscript logs
- Errors related to path resolution in PostScript processing
Network Indicators:
- Unexpected file read attempts from Ghostscript processes
SIEM Query:
Process execution logs where gs processes access files outside expected directories