CVE-2017-8291
Artifex Ghostscript Type Confusion Vulnerability
Description
CVE-2017-8291 is a remote code execution vulnerability in Artifex Ghostscript, a widely used interpreter for PostScript and PDF files. The vulnerability allows attackers to bypass the -dSAFER sandbox restriction through a type confusion flaw involving the .rsdparams operator combined with a /OutputFile parameter, enabling arbitrary command execution on the host system. Ghostscript is embedded in numerous applications and services for document processing, making this vulnerability particularly impactful across many software stacks. CVE-2017-8291 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and its EPSS percentile of 99.7% indicates near-certain exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| artifex | ghostscript | < 9.21 |
| debian | debian linux | 8.0 |
| redhat | enterprise linux desktop | 6.0; 7.0 |
| redhat | enterprise linux eus | 7.3; 7.4; 7.5; 7.6; 7.7 |
| redhat | enterprise linux server | 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.3; 7.4; 7.6; 7.7 |
| redhat | enterprise linux server tus | 7.3; 7.6; 7.7 |
| redhat | enterprise linux workstation | 6.0; 7.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://openwall.com/lists/oss-security/2017/04/28/2(Mailing List, Patch, Third Party Advisory)
- http://www.debian.org/security/2017/dsa-3838(Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/98476(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2017:1230(Third Party Advisory)
- https://bugs.ghostscript.com/show_bug.cgi?id=697808(Issue Tracking, Third Party Advisory, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=1446063(Issue Tracking, Patch, Third Party Advisory, VDB Entry)
- https://bugzilla.suse.com/show_bug.cgi?id=1036453(Exploit, Issue Tracking, Third Party Advisory, VDB Entry)
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d(Broken Link)
- https://security.gentoo.org/glsa/201708-06(Third Party Advisory)
- https://www.exploit-db.com/exploits/41955/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291(US Government Resource)
Weakness Type
CWE-704: Incorrect Type Conversion or Cast
CWE-704 describes a weakness where a product does not correctly convert or cast data from one type to another, leading to unexpected behavior. In CVE-2017-8291, a type confusion in Ghostscript's handling of the .rsdparams operator allows an attacker to bypass the -dSAFER sandbox and specify an /OutputFile parameter that triggers arbitrary command execution, effectively escaping the intended security restrictions of the interpreter.
Learn more: CWE-704 — Incorrect Type Conversion or Cast
Impact Analysis
CVE-2017-8291 enables remote command execution on any system running a vulnerable version of Artifex Ghostscript. The vulnerability is particularly severe because Ghostscript is widely embedded in image processing libraries (such as ImageMagick), web applications, mail servers, and document conversion services, many of which process untrusted user-uploaded files. An attacker can craft a malicious PostScript or EPS file that, when processed by Ghostscript, executes arbitrary operating system commands with the privileges of the Ghostscript process. The EPSS percentile of 99.7% reflects near-certain active exploitation, and CISA's inclusion in the KEV catalog confirms real-world attacks. The impact spans confidentiality, integrity, and availability, as successful exploitation grants the attacker shell access to the underlying system.
Exploit Maturity
CVE-2017-8291 has been extensively exploited since its disclosure in 2017. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 99.7% places it among the most exploited vulnerabilities ever cataloged. Public exploit code is widely available, and the vulnerability has been leveraged in attacks against web applications and document processing services that use Ghostscript as a backend. The exploitation pattern typically involves uploading a crafted PostScript, EPS, or PDF file to a service that processes it with Ghostscript, triggering the sandbox bypass and achieving remote command execution without any authentication.
Remediation
- Update Artifex Ghostscript to version 9.22 or later, which addresses CVE-2017-8291. Apply updates per vendor instructions as required by CISA's KEV catalog.
- If immediate patching is not possible, disable the processing of PostScript and EPS files in applications that use Ghostscript as a backend, particularly in web-facing services that accept user-uploaded documents.
- Configure Ghostscript with strict policy files that restrict file system access and command execution, even when the -dSAFER flag is used, to provide defense-in-depth.
- Review all applications in your environment that depend on Ghostscript for document processing, including ImageMagick, GraphicsMagick, and custom document conversion pipelines, and ensure they are configured to use the patched version.
- Implement file type validation and sandboxing for user-uploaded documents, processing them in isolated environments with restricted network access and filesystem permissions to limit the impact of any future Ghostscript vulnerabilities.
Technical Details
CVE-2017-8291 exploits a type confusion vulnerability in Artifex Ghostscript's PostScript interpreter. The -dSAFER flag is intended to restrict Ghostscript from performing dangerous operations like writing files or executing commands, but the .rsdparams operator does not properly validate parameter types. An attacker can craft a PostScript document that uses this type confusion to set the /OutputFile parameter to a pipe command (e.g., /OutputFile (%pipe%command)), causing Ghostscript to execute arbitrary shell commands when processing the file. This effectively bypasses the -dSAFER sandbox entirely. The attack requires no authentication and can be triggered remotely whenever a vulnerable Ghostscript instance processes attacker-controlled input, which is common in web applications that convert uploaded documents or generate thumbnails. The vulnerability is classified under CWE-704 (Incorrect Type Conversion or Cast) because the root cause is the interpreter's failure to enforce proper type checking on the .rsdparams operator's arguments.
Frequently Asked Questions
Is CVE-2017-8291 being actively exploited?
Yes, CVE-2017-8291 has been extensively exploited since 2017. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 99.7% indicates near-certain exploitation activity. Public exploit code is widely available and has been used in attacks against web applications and document processing services.
What products are affected by CVE-2017-8291?
CVE-2017-8291 directly affects Artifex Ghostscript versions prior to 9.22. However, the impact extends to any software that uses Ghostscript for document processing, including ImageMagick, GraphicsMagick, LibreOffice, and numerous web applications and mail servers that convert or render PostScript, EPS, or PDF files.
How do I fix CVE-2017-8291?
Update Ghostscript to version 9.22 or later. Also review all applications in your environment that depend on Ghostscript and ensure they use the patched version. As an interim measure, disable PostScript/EPS processing in web-facing services. See the Remediation section for detailed steps.
How severe is CVE-2017-8291?
CVE-2017-8291 is a remote code execution vulnerability with an EPSS percentile of 99.7%, indicating near-certain exploitation. The severity is amplified by Ghostscript's widespread use as a backend processor in many applications, meaning a single unpatched Ghostscript installation can expose an entire application stack to command execution attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.