CVE-2024-33870: Path Traversal
An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.
Other sources
When the gpvalidatepathlen function validates a path, it distinguishes between absolute and relative paths. In the case of relative paths, it will check the path with and without the current-directory-prefix ("foo" and "./foo").
The problem is that it doesn't take into account paths with a parent-directory-prefix. So a path like "../../foo" is also tested as "./../../foo" and if the current directory "./" is in the permitted paths, it will pass the check and you can access arbitrary files.
References: ttps://ghostscript.readthedocs.io/en/gs10.03.1/News.html https://bugs.ghostscript.com/showbug.cgi?id=707686
Upstream commit: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685984dc3da2dc090450407d9fbcff80
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33870?
CVE-2024-33870 is classified as a high severity vulnerability due to its potential for path traversal attacks.
How do I fix CVE-2024-33870?
To mitigate CVE-2024-33870, upgrade Ghostscript to version 10.03.1 or later.
What types of systems are affected by CVE-2024-33870?
CVE-2024-33870 affects Ghostscript versions prior to 10.03.1 on various operating systems including Debian and Red Hat.
What is the impact of CVE-2024-33870?
CVE-2024-33870 allows attackers to access arbitrary files through a crafted PostScript document, compromising system confidentiality.
Is there a workaround for CVE-2024-33870?
A temporary workaround for CVE-2024-33870 includes restricting access to allowed directories and avoiding the processing of untrusted PostScript documents.