Ghostscript CVE-2023-36664: Command Injection via Pipe Device Filename

Ghostscript version ghostpdl-10.01.1 contains a command injection vulnerability in the pipe device handler. When processing PostScript files that specify output filenames starting with '|', the filename is passed unsanitized to popen(), allowing arbitrary command execution. An attacker can craft a malicious PostScript file with an output filename like '|malicious_command' to execute arbitrary OS commands with the privileges of the Ghostscript process.", "investigation_notes":"Located the vulnerability by examining the pipe device handler in gdevpipe.c. The fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization. Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen(). The vulnerability is that popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted.", "solution_description":"The vulnerability can be fixed by sanitizing the fname parameter before passing to popen(). Validate that fname contains only safe characters and reject filenames containing shell metacharacters (|, ;, &, $, backtick, etc.). Alternatively, use posix_spawn() with execv array instead of popen() to avoid shell interpretation entirely. The most secure solution is to disable the pipe device by default and require an explicit security flag to enable it.", "verification_notes":"Confirmed by reading the source code at base/gdevpipe.c lines 44-64, specifically line 55. The popen() call directly uses the fname parameter which comes from PostScript file output specifications. Tested by creating a PoC PostScript file with malicious pipe device filename.", "severity": "critical", "error_type":"command-injection", "error_category":"security", "root_cause_type":"bug", "lang": "c", "lib_versions": {"ghostscript": "ghostpdl-10.01.1"}, "tags": ["command-injection", "ghostscript", "CVE-2023-36664", "popen", "shell-injection"], "artifacts": [ { "kind": "code-excerpt", "role": "manifests", "content": "if (gp_file_FILE_set(*file, popen((char *)fname, (char *)mode), do_pclose)) {\n *file = NULL;\n return_error(gs_fopen_errno_to_code(errno));\n}", "source_path": "base/gdevpipe.c", "source_lines": [55, 58], "language": "c" } ] }