CVE-2021-3781: OS Command Injection
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
The file access protection built into Ghostscript proved insufficient for the "%pipe%" PostScript device, when combined with Ghostscript's requirement to be able to create and control temporary files in the conventional temporary file directories (for example, "/tmp" or "/temp). This exploit is restricted to Unix-like systems (i.e., it doesn't affect Windows). The most severe claimed results are only feasible if the exploit is run as a "high privilege" user (root/superuser level) -- a practice we would discourage under any circumstances.
Resolution: The solution involves including the device specifier string ("%pipe%") in the permissions checking, meaning the entire file name string is validated, rather than (as before) only the sub-string following the device specifier.
This flaw allows to trivially escape the sandbox (enabled with the -dSAFER option). A specially crafted document could use this flaw to execute command on the system, in the context of the ghostscript interpreter.
This flaw affects only version from 9.50 onward.
Upstream bug : https://bugs.ghostscript.com/showbug.cgi?id=704342
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3781?
CVE-2021-3781 is a vulnerability found in the ghostscript interpreter that allows a specially crafted document to execute arbitrary commands on the system.
What is the severity of CVE-2021-3781?
CVE-2021-3781 has a severity rating of 9.9 (Critical).
How does CVE-2021-3781 impact Artifex Ghostscript?
CVE-2021-3781 affects the following versions of Artifex Ghostscript: 9.50, 9.52, 9.53.3, and 9.54.0.
How can I fix CVE-2021-3781?
To fix CVE-2021-3781, it is recommended to update Artifex Ghostscript to a patched version provided by the vendor.
Where can I find more information about CVE-2021-3781?
You can find more information about CVE-2021-3781 in the references provided: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi?id=2002271), [Reference 2](https://ghostscript.com/CVE-2021-3781.html), [Reference 3](https://security.gentoo.org/glsa/202211-11).