Critical RCE found in popular Ghostscript open-source PDF library | Hacker News Reader

Critical RCE found in popular Ghostscript open-source PDF library

bleepingcomputer.com

102 pointsthedday24 comments

My favorite RCE, FORCEDENTRY[0], also involved PDFs. It was the first time I was truly in awe of an exploit.

Through a combination of (1) an integer overflow in an open-source PDF compression library, (2) a Turing-complete compression codec, and (3) CoreGraphics noticing that the "gif" in your iMessage is actually a PDF and helpfully decoding it for you, NSO was able to bootstrap a purpose-built virtual machine, upon which they ran their sandbox-escape.

I highly recommend reading this post[1] by Project Zero if you haven't already.

[0]https://en.wikipedia.org/wiki/FORCEDENTRY

[1]https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

I've said it before and I'll say it again: ghostscript will never be safe, ever.

If you must run it then make it 100% isolated, for instance in a lambda with no api credentials or IAM permissions, & do s3 input/output by passing presigned urls. Make it ok to have RCE.

And make sure never to re-use one lambda function or container to process more than a single customer's data, to avoid the RCE gaining access to whatever file next gets uploaded :)

The article is from yesterday and at first it scared me into thinking it was yet another vulnerability. Turns out it's from weeks ago and Debian patched it 10 days ago. Whew.

I would not exhale too fast. Ghostscript is embedded all over the place.

Is there a 'ghostscript' server I dont know about ?

Where is the "Remote" in this RCE ?

Ghostscript seems to be often used as a backend tool in automated pipelines.

So, the whole RCE thing is probably pretty true in this case.

If we classify flaws this way though, everything is access able to be accessed via ssh, etc. CVE flaws have an an 'environment' section for exactly this purpose.

Yeah, that's a fair point.

They might be stressing the "remote" bit though, just so it sinks in for people using it as part of a document conversion pipeline or something. But, that's just me guessing wildly. :)

I wonder if it is used in phones.

AirPrint is ‘send pdf to the printer and it prints’ and there is a million cloud or cloud like services that use Ghostscript to create thumbnails.

Is there any good replacement to this awful PDF format on the horizon?

There is not. PDF is more ingrained into our tech then ever before. Something like a a quarter or a third of the web is pdfs, it is the default archival format, and the only remotely plausible competitor for the core function of PDF (it more or less looks the same to me as it does to you and you for sure have the software to open it one way or another) is maybe HTML/CSS. There are competitors for the 8,000 other uses of PDFs but only one at a time.

DJVu is the closest equivalent, but it hasn't evolved enough to outshine PDFs in all their uses.

RCE ? Since when is ghostscript a web browser ?

Maybe if you're using it for NeWS.

If an untrusted file can run postscript on your NeWS display server, then yes, you are extremely compromised. (Rather like `curl|sh`, I question if that's meaningful even if it is trivially true.)

RCE (remote code execution) vulnerabilities aren't restricted to web browsers. All it means is "an attacker can execute arbitrary code on the victim's computer". In this case, many people use ghostscript as a server-side component for managing PDF uploads, so an attacker could theoretically upload a malicious PDF and gain control over those servers.

Examples of non-browser RCEs:

* Microsoft Exchange Server and Windows: https://krebsonsecurity.com/2022/01/wormable-flaw-leads-janu...

* Microsoft Office: https://krebsonsecurity.com/2023/07/apple-microsoft-patch-tu...

* Apache Struts: https://krebsonsecurity.com/2018/08/experts-urge-rapid-patch...

Doesn’t have to be a web browser to be vulnerable to remote code execution.

But it is a valid question to ask why it counts as an RCE.

On the one hand, they say:

> Successful exploitation requires user interaction by the victim.

And on the other hand

> Local: No

> Remote: Yes

https://vuldb.com/?id.197290

The bugzilla bug tracker for Ghostscript is currently down for maintenance, so can’t browse it for more details at the moment.

But I wonder if for example a web server that uses Ghostscript to convert documents could be vulnerable. In which case RCE classification makes sense.

Otherwise, do they count it as RCE even if it involves tricking a user into opening a bad file using Ghostscript? If navigating to a bad website with a vulnerable browser counts as RCE in other cases then perhaps opening a bad file with Ghostscript counts as RCE as well?

It's remote in the sense the file comes from elsewhere. It's a problem even if you trust your user (yourself), because you probably open files from untrusted people.

Local priv escalation is something like a root exploit where you don't trust the user.

Thanks, that makes sense :)

> But it is a valid question to ask why it counts as an RCE.

It's an RCE because the form of the attack is that Ghostscript ends up executing code that isn't part of Ghostscript. Code is written outside the system ("remote code") and then executed inside it ("execution").

A malicious PDF that causes Ghostscript to execute arbitrary code would contrast with a malicious PDF that causes Ghostscript to execute inappropriate code that is nevertheless part of Ghostscript. The RCE allows the attacker to do anything the computer can do. The other one allows them to do something (but not necessarily anything) that Ghostscript can do.

Most attacker controlled execution code does not originate inside the binary, most buffer overflows inject shellcode. Using execution code from outside the binary does not make it an RCE.

> But I wonder if for example a web server that uses Ghostscript to convert documents could be vulnerable. In which case RCE classification makes sense.

If this is an RCE then all bugs that could lead to code execution are RCEs because, theoretically, I can put some piece of code in front of it that listens on the network.

This is an unexpected code execution bug. Calling it RCE would suggest that systems that let you double-click on documents to open them are RCEs because I can name an elf executable AliceAndBobAtTheBeach.jpg.

Reply on news.ycombinator.com