CVE-2024-33869: Path Traversal
An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
Other sources
The function "gpvalidatepathlen" first tests if the path has a cwd prefix and then reduces the path.
In the case of a path like "./../tmp/aa" it will first see that it has a cwd prefix and then reduce it to "../tmp/aa". When validation fails, it tries the variant without the cwd prefix by skipping the first two characters. But this will skip the ".." and validate "/tmp/aa", which is an allowed path (on Linux).
References: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html https://bugs.ghostscript.com/showbug.cgi?id=707691
Upstream commits: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33869?
CVE-2024-33869 is considered a high severity vulnerability due to its potential for path traversal and command execution.
How do I fix CVE-2024-33869?
To fix CVE-2024-33869, upgrade to Ghostscript version 10.03.1 or later.
What types of environments are affected by CVE-2024-33869?
CVE-2024-33869 affects environments running versions of Ghostscript prior to 10.03.1.
Can CVE-2024-33869 be exploited through crafted files?
Yes, CVE-2024-33869 can be exploited through crafted PostScript documents that manipulate file paths.
What is the main issue related to CVE-2024-33869?
The main issue of CVE-2024-33869 is path traversal that allows command execution via a crafted input.