CVE-2024-46954
📋 TL;DR
A directory traversal vulnerability in Ghostscript's UTF-8 decoder allows attackers to escape directory restrictions via specially crafted overlong UTF-8 sequences. This affects systems processing untrusted PostScript, PDF, or EPS files with Ghostscript versions before 10.04.0. The vulnerability could allow reading or writing files outside intended directories.
💻 Affected Systems
- Artifex Ghostscript
- Applications using Ghostscript library (e.g., ImageMagick, GIMP, document converters)
📦 What is this software?
Ghostscript by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary file read/write leading to sensitive data exposure, file corruption, or potential remote code execution if combined with other vulnerabilities.
Likely Case
Unauthorized file access allowing attackers to read sensitive configuration files or write malicious files to unexpected locations.
If Mitigated
Limited impact if Ghostscript runs in sandboxed environments with strict file system restrictions and processes only trusted documents.
🎯 Exploit Status
Exploitation requires the attacker to provide a malicious document file to a vulnerable Ghostscript instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.04.0
Vendor Advisory: https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
Restart Required: No
Instructions:
1. Download Ghostscript 10.04.0 or later from official sources. 2. Compile and install following vendor instructions. 3. Restart any services using Ghostscript.
🔧 Temporary Workarounds
Enable SAFER mode
allRun Ghostscript with -dSAFER flag to restrict file system access.
gs -dSAFER -sDEVICE=... input.ps
Disable UTF-8 processing
allConfigure applications to avoid UTF-8 processing in Ghostscript if possible.
🧯 If You Can't Patch
- Isolate Ghostscript processes using containerization or sandboxing with minimal file system permissions.
- Implement strict input validation to reject documents with suspicious UTF-8 sequences before Ghostscript processing.
🔍 How to Verify
Check if Vulnerable:
Check Ghostscript version: gs --version. If version is below 10.04.0, system is vulnerable.Check Version:
gs --versionVerify Fix Applied:
After patching, verify version is 10.04.0 or higher and test with known safe documents.📡 Detection & Monitoring
Log Indicators:
- Ghostscript error logs showing UTF-8 decoding failures
- Unexpected file access patterns in system logs
Network Indicators:
- Large volumes of document uploads to conversion services
SIEM Query:
source="ghostscript.log" AND ("UTF-8" OR "decode" OR "traversal")