CVE-2023-43115 in Ghostscript
Summary
by MITRE • 09/18/2023
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2023
The vulnerability identified as CVE-2023-43115 represents a critical remote code execution flaw within Artifex Ghostscript version 10.01.2 and earlier, specifically affecting the GhostPDL component through the gdevijs.c module. This vulnerability exploits the insecure handling of IJS (Image Java Server) device parameters within the PostScript processing pipeline, creating a pathway for malicious actors to execute arbitrary code on systems running affected Ghostscript versions. The flaw arises from the improper restriction of operations within the SAFER security context, which is designed to prevent dangerous operations during document processing.
The technical implementation of this vulnerability stems from the ability of crafted PostScript documents to manipulate the IJS device configuration after the SAFER security mode has already been activated. This occurs because Ghostscript allows the IJS server parameter to be modified even when SAFER mode is active, creating a window where malicious commands can be executed. The IJS device inherently requires launching an external process to start the IJS server, making it a potential attack vector for command injection. The vulnerability specifically leverages the documented capability of specifying IJS servers through the gs command line interface, which bypasses normal security restrictions that should prevent such operations.
The operational impact of this vulnerability extends beyond simple code execution, as it can enable attackers to perform complete system compromise through the execution of arbitrary commands with the privileges of the Ghostscript process. This risk is particularly severe because Ghostscript is commonly used in server environments, print servers, and document processing pipelines where it may run with elevated privileges. The vulnerability can be exploited through various attack vectors including web applications that process user-uploaded documents, email attachments, or any system that accepts PostScript content for rendering or conversion. The fact that the IJS device can be switched or parameters changed post-SAFER activation creates a persistent security gap that undermines the intended protection mechanisms.
Security mitigations for CVE-2023-43115 should prioritize immediate patching of affected Ghostscript installations to version 10.02.0 or later, which contains the necessary fixes to prevent IJS device manipulation after SAFER mode activation. Organizations should also implement strict input validation and sanitization for all PostScript content, particularly when processing untrusted documents. Network segmentation and access controls should be enforced to limit exposure of Ghostscript instances to untrusted inputs. Additionally, system administrators should consider disabling IJS device support entirely when it is not required for specific use cases, as this eliminates the attack surface associated with external process execution. This vulnerability aligns with CWE-78 and CWE-74 standards related to command injection, and maps to ATT&CK techniques involving execution through command and script interpreters, as well as privilege escalation through process manipulation. Organizations should also monitor for indicators of compromise related to unexpected process creation or execution of external commands through Ghostscript instances.