CVE-2017-8291
published 2017-04-27CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring…
PriorityP187high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-06-14
Exploited in the wild
EPSS
96.97%
99.9th percentile
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | < 9.21 | 9.21 |
| artifex | ghostscript | >= 0 < 9.20~dfsg-3.1 | 9.20~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.20~dfsg-3.1 | 9.20~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.20~dfsg-3.1 | 9.20~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.20~dfsg-3.1 | 9.20~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.10~dfsg-0ubuntu10.7 | 9.10~dfsg-0ubuntu10.7 |
| artifex | ghostscript | >= 0 < 9.10~dfsg-0ubuntu10.9 | 9.10~dfsg-0ubuntu10.9 |
| artifex | ghostscript | >= 0 < 9.18~dfsg~0-0ubuntu2.4 | 9.18~dfsg~0-0ubuntu2.4 |
| artifex | ghostscript | >= 0 < 9.18~dfsg~0-0ubuntu2.6 | 9.18~dfsg~0-0ubuntu2.6 |
| debian | debian_linux | — | — |
| debian | ghostscript | < ghostscript 9.20~dfsg-3.1 (bookworm) | ghostscript 9.20~dfsg-3.1 (bookworm) |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect CVE-2017-8291 exploitation by scanning EPS/PostScript content for the '/OutputFile (%pipe%' substring, which is the key trigger for the -dSAFER bypass and arbitrary command execution via .rsdparams type confusion. ↗
- →Detect CRAT C2 HTTP POST traffic by matching the URL-encoded form data pattern containing 'code=', 'token=', 'content=', 'frags=', and 'limit=10' fields, with requests appended with a '?ts=' timestamp parameter. ↗
- →Detect shellcode execution from within a Ghostscript/HWP exploit chain that spawns PowerShell invoking regsvr32 to download and execute a remote payload — indicative of CRATv1 delivery. ↗
- →The Lazarus campaign's C2 infrastructure relies entirely on IP addresses rather than domains; network detections should focus on direct-IP HTTP C2 beaconing from gs.exe or HWP-spawned child processes. ↗
- ·The CVE-2017-8291 exploit is triggered via embedded PostScript inside HWP documents in observed Lazarus campaigns, but the NVD description confirms it can be triggered via any crafted .eps file passed to the gs program — detection scope should not be limited to HWP files. ↗
- ·The exploit bypasses -dSAFER, meaning Ghostscript instances launched with the SAFER flag are still vulnerable; do not rely on -dSAFER as a mitigation for this CVE. ↗
- ·The four-byte XOR key used to obfuscate the first-stage shellcode is altered between lure documents; signatures based on a specific XOR key value will not generalize across all samples in this campaign. ↗
- ·The vulnerability affects Ghostscript 9.21 and earlier and is exploitable through wrapper libraries such as ImageMagick and Pillow, not only direct gs invocations — detection and patching must cover all products embedding Ghostscript. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Artifex Ghostscript Type Confusion Vulnerability
cisa·2022-05-24·CVSS 7.8
CVE-2017-8291 [HIGH] CWE-704 Artifex Ghostscript Type Confusion Vulnerability
Vulnerability: Artifex Ghostscript Type Confusion Vulnerability
Affected: Artifex Ghostscript
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-8291
Remediation Due Date: 2022-06-14
Ubuntu
Ghostscript regression
vendor_ubuntu·2017-05-16·CVSS 5.5
[MEDIUM] Ghostscript regression
Title: Ghostscript regression
Summary: USN-3272-1 introduced a regression in Ghostscript.
USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced
a regression when the DELAYBIND feature is used with the eqproc
command. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Ghostscript improperly handled parameters to
the rsdparams and eqproc commands. An attacker could use these to
craft a malicious document that could disable -dSAFER protections,
thereby allowing the execution of arbitrary code, or cause a denial
of service (application crash). (CVE-2017-8291)
Kamil Frankowicz discovered a use-after-free vulnerability in the
color management module of Ghostscript. An attacker could use this
to cause a deni
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2017-04-28·CVSS 5.5
CVE-2016-10217 [MEDIUM] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Several security issues were fixed in Ghostscript.
It was discovered that Ghostscript improperly handled parameters to
the rsdparams and eqproc commands. An attacker could use these to
craft a malicious document that could disable -dSAFER protections,
thereby allowing the execution of arbitrary code, or cause a denial
of service (application crash). (CVE-2017-8291)
Kamil Frankowicz discovered a use-after-free vulnerability in the
color management module of Ghostscript. An attacker could use this
to cause a denial of service (application crash). (CVE-2016-10217)
Kamil Frankowicz discovered a divide-by-zero error in the scan
conversion code in Ghostscript. An attacker could use this to cause
a denial of service (application crash). (CVE-2016-10
Red Hat
ghostscript: corruption of operand stack
vendor_redhat·2017-04-26·CVSS 7.8
CVE-2017-8291 [HIGH] CWE-77 ghostscript: corruption of operand stack
ghostscript: corruption of operand stack
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection.
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostscript (Red Hat OpenShift Enterprise 2) - Under investigation
Debian
CVE-2017-8291: ghostscript - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command ...
vendor_debian·2017·CVSS 7.8
CVE-2017-8291 [HIGH] CVE-2017-8291: ghostscript - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command ...
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Scope: local
bookworm: resolved (fixed in 9.20~dfsg-3.1)
bullseye: resolved (fixed in 9.20~dfsg-3.1)
forky: resolved (fixed in 9.20~dfsg-3.1)
sid: resolved (fixed in 9.20~dfsg-3.1)
trixie: resolved (fixed in 9.20~dfsg-3.1)
GHSA
GHSA-rh88-cwv2-gjxm: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via
ghsa_unreviewed·2022-05-14
CVE-2017-8291 [HIGH] CWE-704 GHSA-rh88-cwv2-gjxm: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
OSV
ghostscript regression
osv·2017-05-16·CVSS 5.5
[MEDIUM] ghostscript regression
ghostscript regression
USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced
a regression when the DELAYBIND feature is used with the eqproc
command. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Ghostscript improperly handled parameters to
the rsdparams and eqproc commands. An attacker could use these to
craft a malicious document that could disable -dSAFER protections,
thereby allowing the execution of arbitrary code, or cause a denial
of service (application crash). (CVE-2017-8291)
Kamil Frankowicz discovered a use-after-free vulnerability in the
color management module of Ghostscript. An attacker could use this
to cause a denial of service (application crash). (CVE-2016-10217)
Kamil Frankowic
OSV
ghostscript vulnerabilities
osv·2017-04-28·CVSS 5.5
CVE-2017-8291 [MEDIUM] ghostscript vulnerabilities
ghostscript vulnerabilities
It was discovered that Ghostscript improperly handled parameters to
the rsdparams and eqproc commands. An attacker could use these to
craft a malicious document that could disable -dSAFER protections,
thereby allowing the execution of arbitrary code, or cause a denial
of service (application crash). (CVE-2017-8291)
Kamil Frankowicz discovered a use-after-free vulnerability in the
color management module of Ghostscript. An attacker could use this
to cause a denial of service (application crash). (CVE-2016-10217)
Kamil Frankowicz discovered a divide-by-zero error in the scan
conversion code in Ghostscript. An attacker could use this to cause
a denial of service (application crash). (CVE-2016-10219)
Kamil Frankowicz discovered multiple NULL pointer dereference
OSV
CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via
osv·2017-04-27·CVSS 7.8
CVE-2017-8291 [HIGH] CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
VulnCheck
Artifex Ghostscript Type Confusion Vulnerability
vulncheck·2017·CVSS 7.8
CVE-2017-8291 [HIGH] CWE-704 Artifex Ghostscript Type Confusion Vulnerability
Artifex Ghostscript Type Confusion Vulnerability
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Affected: Artifex Ghostscript
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cve.org/CVERecord?id=CVE-2017-8291; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://asec.ahnlab.com/ko/47622/; https://www.fsec.or.kr/bbs/detail?menuNo=244&bbsNo=11839
Exploit PoC: https://vulncheck.com/xdb/094166e5b7b5; https://vulncheck.com/xdb/f15ef2684963; https://vulncheck.com/xdb/32af267712cb
Remediation Due: 2022-06-14
No detection rules found.
HackerOne
Remote code execution on Basecamp.com
hackerone·2020-11-26·CVSS 7.8
[HIGH] Remote code execution on Basecamp.com
Remote code execution on Basecamp.com
A critical flaw in Basecamp's profile image upload function leads to remote command execution. Images are converted on the server side, but not only image files but also PostScript/EPS files are accepted (if renamed to .gif). This is probably due to ImageMagick / GraphicsMagick being used for image conversion, which calls a PostScript interpreter (Ghostscript) if the input file starts with '%!'. The used Ghostscript version however has a security bug (CVE-2017-8291) leading to remote command execution.
/Proof of concept/: Upload the attached rce.gif file as profile image (change the `ping -c1 attacker.com' to some other shell command).
/Mitigation/: Upgrade Ghostscript; also, before processing uploaded images make sure they are real image files (e.g
Bugzilla
CVE-2017-8291 ghostscript: corruption of operand stack
bugzilla·2017-04-27·CVSS 7.8
CVE-2017-8291 [HIGH] CVE-2017-8291 ghostscript: corruption of operand stack
CVE-2017-8291 ghostscript: corruption of operand stack
It was reported that Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program.
Upstream issue:
https://bugs.ghostscript.com/show_bug.cgi?id=697808
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1446064]
---
[Updated] Upstream patches:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce1
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac
---
This is a duplicate of https://bugzilla.redh
Bugzilla
CVE-2017-8291 ghostscript: -dSAFER bypass and command execution via a "/OutputFile (%pipe%" substring [fedora-all]
bugzilla·2017-04-27·CVSS 7.8
CVE-2017-8291 [HIGH] CVE-2017-8291 ghostscript: -dSAFER bypass and command execution via a "/OutputFile (%pipe%" substring [fedora-all]
CVE-2017-8291 ghostscript: -dSAFER bypass and command execution via a "/OutputFile (%pipe%" substring [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issu
CTF
pillow / README
ctf_writeups·2017·CVSS 7.8
CVE-2017-8291 [HIGH] pillow / README
### Title
> pillow
### Description
#### en
>
#### cn
> Python? PIL?
>
> Try to get Internal Server Error.
### Category
> misc
### Deployment
> ```shell
> cd docker_env/
> docker-compose build
> docker-compose up -d
> ```
### Flag
> `nuaactf{W3lc0me_to_Asuri}`
### Score
> 500
### Hint
> Python PIL Module CVE
### Attachment
>
### Vulnerability
> CVE-2017-8291
### Tool
>
### Tag
>
Talos
CRAT wants to plunder your endpoints
blogs_talos·2020-11-12
CRAT wants to plunder your endpoints
## CRAT wants to plunder your endpoints
Cisco Talos has observed a new version of a remote access trojan (RAT) family known as CRAT.
Apart from the prebuilt RAT capabilities, the malware can download and deploy additional malicious plugins on the infected endpoint.
One of the plugins is a ransomware known as "Hansom."
CRAT has been attributed to the Lazarus APT Group in the past.
The RAT consists of multiple obfuscation techniques to hide strings, API names, command and control (C2) URLs and instrumental functions, along with static detection evasion.
The attack also employs a multitude of anti-infection checks to evade sandbox based detection systems.
## What's new?
Cisco Talos has recently discovered a new version of the CRAT malware family. This version consists of multiple RAT
Talos
CRAT wants to plunder your endpoints
blogs_talos·2020-11-12
CRAT wants to plunder your endpoints
- Cisco Talos has observed a new version of a remote access trojan (RAT) family known as CRAT.
- Apart from the prebuilt RAT capabilities, the malware can download and deploy additional malicious plugins on the infected endpoint.
- One of the plugins is a ransomware known as "Hansom."
- CRAT has been attributed to the Lazarus APT Group in the past.
- The RAT consists of multiple obfuscation techniques to hide strings, API names, command and control (C2) URLs and instrumental functions, along with static detection evasion.
- The attack also employs a multitude of anti-infection checks to evade sandbox based detection systems.
## What's new?
Cisco Talos has recently discovered a new version of the CRAT malware family. This version consists of multiple RAT capabilities, additional plugins a
Recorded Future
North Korea's Late 2017 Campaign Targeted South Korean Cryptocurrency Users
blogs_recorded_future·CVSS 7.8
[HIGH] North Korea's Late 2017 Campaign Targeted South Korean Cryptocurrency Users
# North Korea Targeted South Korean Cryptocurrency Users and Exchange in Late 2017 Campaign
### Key Judgements
- North Korean government actors, specifically Lazarus Group, continued to target South Korean cryptocurrency exchanges and users in late 2017, before Kim Jong Un’s New Year’s speech and subsequent North-South dialogue.
- This campaign also targeted South Korean college students interested in foreign affairs and part of a group called “Friends of MOFA” (Ministry of Foreign Affairs).
- The malware employed shared code with Destover malware, which was used against Sony Pictures Entertainment in 2014 and the first WannaCry victim in February 2017.
- The dropper in this campaign exploited a known Ghostscript vulnerability, CVE-2017-8291. The exploit implementation includes Chinese t
Recorded Future
North Korea's Late 2017 Campaign Targeted South Korean Cryptocurrency Users | Recorded Future
blogs_recorded_future·CVSS 7.8
[HIGH] North Korea's Late 2017 Campaign Targeted South Korean Cryptocurrency Users | Recorded Future
## North Korea Targeted South Korean Cryptocurrency Users and Exchange in Late 2017 Campaign
## Key Judgements
North Korean government actors, specifically Lazarus Group, continued to target South Korean cryptocurrency exchanges and users in late 2017, before Kim Jong Un’s New Year’s speech and subsequent North-South dialogue .
This campaign also targeted South Korean college students interested in foreign affairs and part of a group called “Friends of MOFA” (Ministry of Foreign Affairs).
The malware employed shared code with Destover malware, which was used against Sony Pictures Entertainment in 2014 and the first WannaCry victim in February 2017.
The dropper in this campaign exploited a known Ghostscript vulnerability, CVE-2017-8291. The exploit implementation includes Chinese terms
http://openwall.com/lists/oss-security/2017/04/28/2http://www.debian.org/security/2017/dsa-3838http://www.securityfocus.com/bid/98476https://access.redhat.com/errata/RHSA-2017:1230https://bugs.ghostscript.com/show_bug.cgi?id=697808https://bugzilla.redhat.com/show_bug.cgi?id=1446063https://bugzilla.suse.com/show_bug.cgi?id=1036453https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47dhttps://security.gentoo.org/glsa/201708-06https://www.exploit-db.com/exploits/41955/http://openwall.com/lists/oss-security/2017/04/28/2http://www.debian.org/security/2017/dsa-3838http://www.securityfocus.com/bid/98476https://access.redhat.com/errata/RHSA-2017:1230https://bugs.ghostscript.com/show_bug.cgi?id=697808https://bugzilla.redhat.com/show_bug.cgi?id=1446063https://bugzilla.suse.com/show_bug.cgi?id=1036453https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47dhttps://security.gentoo.org/glsa/201708-06https://www.exploit-db.com/exploits/41955/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291
2017-04-27
Published
2022-05-24
Added to CISA KEV
Exploited in the wild