Ghostscript Fixes Critical RCE Flaw Triggered by Malicious PDFs

Most people never think about Ghostscript. Still, this free tool runs quietly on many web servers. It reads PDF files and turns them into images. As a result, a flaw in it can put a lot of sites at risk.

Security firm Wordfence found such a flaw. In short, a rigged PDF can make a vulnerable server run an attacker’s commands. The bug scores 9.8 out of 10 for severity. Artifex, the maker of Ghostscript, has already released a fix.

What the Flaw does

This vulnerability is reportedly tied to how JPEG images get handled in PDFs.  A crafted file can describe the image in a confusing way. For example, it can mix up the size of the image parts. Ghostscript then sets aside too little memory. Next, it writes too much data into that space. The extra data spills into nearby memory and corrupts it.

In Wordfence’s tests, two exploits forced Ghostscript to write 1,024 bytes into a 256-byte space. That mess let the researchers run their own code. In other words, they took over a test WordPress site without logging in.

Wordfence found the vulnerability on August 23 and quietly let Artifex know. Ghostscript has been housing this flaw for a long time, with its first appearance being version 9.21. It affects 9.21 all the way to version 10.07.1.

Artifex finally fixed it in version 10.08.0, which dropped on September 8. The public CVE record followed on September 15. Wordfence says Artifex confirmed the report one day after Wordfence sent it.

How a Website Gets Caught

WordPress sites are reportedly susceptible to this exploit. When uploading a PDF, WordPress creates a thumbnail from it. To achieve that, it uses a program called ImageMagick. ImageMagick then starts Ghostscript. So a bad PDF can reach the weak code without touching WordPress itself.

Wordfence found the bug during a WordPress 7.1 review, using its AI-powered tool, Argus. Even so, the team stresses that this is not only a WordPress problem. Applications that render PDF files from untrusted users using the vulnerable Ghostscript may be prone to this vulnerability. Whether or not an attacker requires login access will depend on the app.

On WordPress, four conditions have to exist simultaneously:

1. One can upload a PDF document without registration or using a low-privileged user account.
2. The website creates a preview or a thumbnail for the uploaded file.
3. The process reaches Ghostscript, and the settings allow PDF rendering.
4. The installed Ghostscript still has the flawed code.

Stock WordPress does not let anonymous visitors upload to the Media Library. Therefore, many sites are safer than they first appear. Plugins that accept public uploads, however, could change that.

WordPress plugins can also expose websites to other security threats. In a separate incident, hackers exploited a critical flaw in a WooCommerce plugin in more than 100,000 attack attempts.

The Flaw is Easy in Theory, but Harder in Practice

The severity score describes a worst case. Wordfence itself says the number is not a promise. Red Hat agrees in part. It rates its own update for this bug as moderate.

The team actually ran tests on ten different Linux setups like Debian, Ubuntu, Fedora, Alpine, AlmaLinux, etc.  All of them held the flawed code. Yet the researchers ran their exploits 10,240 times against Linux packages and never got code to run. Only a custom-built test server fell to the attack.

Then they tweaked things like fonts, language settings, how fonts were set up, and even changed a key system library. After those changes, the attack worked, just not every time. Still, Wordfence points out that “harder” isn’t the same as “safe.”

Attackers just adapt their payloads to whatever system they find. In short, your risk depends on how your server is built, and guessing is a poor plan. Besides, the official WordPress Docker image that the team tested was vulnerable.

Meanwhile, the news so far is calm. Wordfence has found no public sign of attacks. A small test file that only crashes Ghostscript is public. However, the code-running exploits are not.

How to Address the Issue

The first step is to update Ghostscript to version 10.08.0 or newer. If you’re on a managed host, ask your provider if their package includes the fix. The big-name Linux vendors — Debian, Ubuntu, SUSE, and Red Hat — have all rolled out patches. Watch out for version numbers, though. Sometimes vendors patch an old release but leave the number the same. That’s why checking the vendor’s notes is important.

For those who run Ghostscript in Docker, rebuild your containers using an updated base image.  Then redeploy them. Doing a plugin update alone won’t cut it because the flaw doesn’t reside inside WordPress, but outside of it.

Last but not least, if for any reason you can’t do the patch yet, just block PDF uploads altogether. Alternatively, turn off PDF rendering in ImageMagick. Wordfence also warns against treating Ghostscript’s -dSAFER setting as a fix.

Wordfence has found no public sign of attacks so far. Even so, the details are public, and the fix has been out for more than a month. So the safest move is simple. Patch the server, check the package notes, and limit who can upload files.