Ghostscript for Windows Local Privilege Escalation via PostScript Hijacking

Executive Summary

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Ghostscript searches for PostScript resource files in predictable paths under C:\gs\ that do not exist by default on Windows. An authenticated local user can create these directories and plant a malicious PostScript file. When Ghostscript runs, it loads and executes this file with full privileges, allowing arbitrary code execution on the machine.

Useful 0 Not Useful 0

Detection Guidance

Check for the existence of the C:\gs\ directory and verify if any unauthorized PostScript files are present. Inspect Ghostscript process execution logs for unexpected file loads from C:\gs\. Use Windows ACL tools to review directory creation permissions at C:\ root.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated local attacker to escalate privileges and execute arbitrary code on the machine with Ghostscript process privileges. This could lead to full system compromise, data theft, or installation of malware. Any user or service running Ghostscript is affected if the malicious file is planted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance. Unauthorized code execution may result in data breaches, loss of confidentiality, or integrity issues, requiring organizations to address the flaw to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ghostscript to version 10.08.0 or later. Remove or restrict write permissions at the C:\ root to prevent unauthorized directory creation. Monitor for suspicious PostScript files in C:\gs\ paths.

Useful 0 Not Useful 0