🚨 CVE-2024-29510 : GHOSTSCRIPT FORMAT STRING INJECTION + SAFER SANDBOX BYPASS RCE ALERT 🚨 Ghostscript A critical unauthenticated remote code execution vulnerability has been disclosed in Ghostscript, allowing attackers to bypass the SAFER sandbox via format string injection, leading to full code execution during document processing. Risk Severity: Critical (Public PoC + high exploit reliability, immediate patching required) Impact: • Full remote code execution (RCE) in Ghostscript process context • Complete SAFER sandbox bypass enabling unrestricted dangerous operator access • Server compromise in document processing pipelines • Potential system takeover when Ghostscript runs with elevated privileges • Exposure of sensitive documents and internal processing queues Root Cause: CWE-134 Use of Externally-Controlled Format String Improper sanitization of format string specifiers in uniprint device parameter handling allows attackers to trigger arbitrary memory corruption. Exploitation occurs before SAFER sandbox enforcement, completely nullifying Ghostscript’s primary security boundary. Attackers can: • Upload malicious PDF or PostScript documents • Inject crafted format string payloads such as %n %s %x • Trigger arbitrary memory read and write • Escape SAFER sandbox • Achieve full remote code execution • Compromise backend document processing servers • Pivot into internal infrastructure Are You Affected? Vulnerable: Ghostscript earlier than 10.03.1 and downstream applications embedding Ghostscript including ImageMagick, LibreOffice, CMS upload pipelines, cloud document services, and print servers Fixed in: Ghostscript 10.03.1 Immediate Actions: Patch Now: Upgrade to Ghostscript 10.03.1 or later immediately Mitigation (if patching is delayed): Disable Ghostscript delegates, restrict PDF and PS processing, isolate document processing servers Audit and Monitor: Review Ghostscript crashes, suspicious uploads, unexpected child processes, and outbound connections Incident Response: If exposed, isolate host, rotate secrets, preserve forensic artifacts, and review all processed documents Given Ghostscript’s massive deployment footprint, this is a high blast radius vulnerability treat exploitation as likely and patch immediately 🛡️ #ostorlabCVE
Post summary
The alert announces a critical, unauthenticated RCE in Ghostscript via format string injection with a public PoC; immediate patching to 10.03.1 is required to mitigate the sandbox bypass.