Ghostscript Type Confusion Arbitrary Command Execution
Title source: metasploitExploitation Summary
CVE-2017-8291 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 24, 2022.
EIP tracks 6 public exploits from researchers including Metasploit, DaniilOrchikov, hkcfs, including a Metasploit module exploits/unix/fileformat/ghostscript_type_confusion.
AI-analyzed exploit summary This Metasploit module exploits a type confusion vulnerability in Ghostscript (CVE-2017-8291) to achieve arbitrary command execution. It generates a malicious EPS file that, when processed by Ghostscript, executes the embedded payload.
Description
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Exploits (6)
This Metasploit module exploits a type confusion vulnerability in Ghostscript (CVE-2017-8291) to achieve arbitrary command execution. It generates a malicious EPS file that, when processed by Ghostscript, executes the embedded payload.
This repository contains a working PoC for CVE-2017-8291, demonstrating RCE in Python PIL/Pillow via GhostScript's EPS processing. The Flask app allows uploading a malicious EPS file disguised as a PNG, exploiting the GhostButt vulnerability to execute arbitrary commands.
This repository contains a working PoC for CVE-2017-8291, exploiting a remote command execution vulnerability in Python's PIL (Pillow) module via GhostScript's sandbox bypass. The Flask app demonstrates the vulnerability by allowing EPS files disguised as PNGs to execute arbitrary commands.
This repository contains a working PoC for CVE-2017-8291, demonstrating an RCE vulnerability in Python Imaging Library (PIL) due to improper file type handling. The exploit leverages GhostScript command injection via a maliciously crafted EPS file disguised as a PNG.
This repository contains a working PoC for CVE-2017-8291, demonstrating remote command execution via Python PIL/Pillow's handling of EPS files through GhostScript. The Flask app allows file uploads with extension checks bypassed by exploiting file header detection.
This Metasploit module exploits a type confusion vulnerability in Ghostscript (CVE-2017-8291) to achieve arbitrary command execution. It generates a malicious EPS file that triggers the vulnerability when processed by Ghostscript.
References (11)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H