Example Analysis of remote Command execution vulnerability bypassed by ghostscript Sandbox

This article will explain in detail the example analysis of ghostscript sandbox bypass remote command execution vulnerabilities. The editor thinks it is very practical, so I share it with you as a reference. I hope you can get something after reading this article.

0x00 vulnerability background

On Nov. 21, Man Yue Mo, a security researcher on the Semmle team, pointed out again through semmle's official website [https://semmle.com/news/semmle-discovers-severe-vulnerability-ghostscript-postscript-pdf]] that ghostscript's security sandbox can be bypassed and can cause remote command execution by constructing malicious PDF content.

Ghostscript is widely used, such as ImageMagick, python-matplotlib, libmagick and other image processing applications.

Impact of 0x01 vulnerabilities

After checking the version, 360CERT confirms that the version of commit corresponding to 9.26 RELEASE is

867deb44ce59102b3c817b8228d9cbfd9d9b1fde

So the affected version is

Version