{"id":101245,"date":"2021-09-10T22:22:37","date_gmt":"2021-09-10T20:22:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick"},"modified":"2021-09-10T22:22:37","modified_gmt":"2021-09-10T20:22:37","slug":"uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","title":{"rendered":"Vulnerability in Ghostscript exploited via ImageMagick","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In Ghostscript, a toolkit for processing, converting, and generating documents in PostScript and PDF formats, a critical vulnerability (CVE-2021-3781) has been identified that allows arbitrary code execution when handling a specially crafted file. The issue was initially pointed out by Emil Lerner, who discussed the vulnerability on August 25 at the ZeroNights X conference in St. Petersburg (the presentation revealed how Emil used the vulnerability within bug bounty programs to earn rewards for demonstrating attacks on services like AirBNB, Dropbox, and Yandex.Real Estate). <\/p>\n
On September 5, a working exploit was made publicly available, enabling attacks on systems with Ubuntu 20.04 by submitting a specially crafted document disguised as an image to a web script running on the server that uses the php-imagemagick package. Preliminary reports suggest that this exploit has been in circulation since March. It was initially claimed that it could target systems running GhostScript 9.50, but it was later discovered that the vulnerability is present in all subsequent versions of GhostScript, including the upcoming 9.55 release from Git. <\/p>\n
A fix was proposed on September 8 and accepted into the GhostScript repository after review on September 9. In many distributions, the issue remains unaddressed (the status of update releases can be monitored on the pages for Debian, Ubuntu, Fedora, SUSE, RHEL, Arch Linux, FreeBSD, and NetBSD). The GhostScript release that resolves the vulnerability is expected to be published by the end of the month. <\/p>\n
The issue is caused by the ability to bypass the isolation mode «-dSAFER» due to insufficient validation of the parameters of the Postscript device «%pipe%», which allowed for the execution of arbitrary shell commands. For example, to launch the id utility in a document, it is sufficient to specify the string «(%pipe%\/tmp\/&id)(w)file» or «(%pipe%\/tmp\/;id)(r)file». <\/p>\n
It is important to note that vulnerabilities in Ghostscript pose a heightened risk, as this package is used in many popular applications for processing PostScript and PDF formats. For example, Ghostscript is called during the creation of thumbnails on the desktop, during background data indexing, and when converting images. In many cases, simply uploading an exploit file or browsing a directory containing it in a file manager that supports document thumbnail previews, such as Nautilus, is sufficient for a successful attack. <\/p>\n