Exploitation Summary
EIP tracks 4 public exploits for CVE-2023-36664. PoCs published by jakabakos, churamanib, jeanchpt.
AI-analyzed exploit summary This repository contains a Python script that exploits CVE-2023-36664, a command injection vulnerability in Ghostscript prior to version 10.01.2. The exploit generates or injects malicious payloads into PS or EPS files, which execute arbitrary commands when processed by vulnerable Ghostscript versions.
Description
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Exploits (4)
This repository contains a Python script that exploits CVE-2023-36664, a command injection vulnerability in Ghostscript prior to version 10.01.2. The exploit generates or injects malicious payloads into PS or EPS files, which execute arbitrary commands when processed by vulnerable Ghostscript versions.
This repository contains a Python script that exploits CVE-2023-36664, a command injection vulnerability in Ghostscript prior to version 10.01.2. The exploit generates or injects malicious payloads into PS or EPS files, which execute arbitrary commands when processed by vulnerable Ghostscript versions.
This PoC exploits CVE-2023-36664 in Ghostscript by injecting a malicious payload into an EPS file, which triggers remote code execution when opened in LibreOffice Draw. The payload leverages Ghostscript's pipe device to execute arbitrary commands.
This PowerShell script scans for GhostScript files vulnerable to CVE-2023-36664 by checking file versions across local drives. It self-elevates to administrator privileges if required and lists affected files.
References (7)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H