CVE-2024-33871

Vulnerability

The vulnerability resides in contrib/opvp/gdevopvp.c in Artifex Ghostscript versions before 10.03.1. The Driver parameter for the opvp (and oprp) devices accepts an arbitrary library name, which Ghostscript then attempts to load via dlopen(). This allows an attacker to specify any shared library on the filesystem as the driver. The code path is reachable when processing a PostScript document that opens the opvp or oprp device with a user-controlled -dDriver= parameter.

Exploitation

An attacker needs the ability to supply a crafted PostScript document to a target running a vulnerable version of Ghostscript. No authentication is required if the document is processed by a service (e.g., a document converter or print spooler). The attacker must know the filesystem path to a malicious shared library (or to an existing system library with exploitable side effects). The concrete sequence involves crafting a PostScript file that invokes the opvp device with a -dDriver=/path/to/malicious.so parameter; upon device initialization, Ghostscript loads and executes code from the specified library.

Impact

Successful exploitation results in arbitrary code execution with the privileges of the Ghostscript process. This can lead to full compromise of the affected system, including data exfiltration, installation of malware, or lateral movement within a network. The CVSS v3.1 base score is 8.8 (High) per Red Hat [1].

Mitigation

The fix was released in Ghostscript version 10.03.1 on 2024-05-02 [1]. Upgrading to this version or later is the recommended mitigation. Users unable to upgrade should ensure that untrusted PostScript documents are not processed by vulnerable versions and consider disallowing use of the opvp/oprp devices if not needed. No workaround is provided by the vendor. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of July 2024.