Artifex Ghostscript through 2017-04-26

CVE-2017-8291 is a type confusion in Artifex Ghostscript ≤ 9.21 that lets an attacker bypass the -dSAFER sandbox and execute arbitrary OS commands by crafting a malicious .eps (or .ps) file containing a /OutputFile (%pipe%… directive routed through .rsdparams. The bug was a zero-day exploited in the wild in April 2017. Affected versions: Ghostscript ≤ 9.21, which ships as a default dependency on most Linux distributions and is invoked transparently by ImageMagick, Pillow (PIL), GraphicsMagick, and dozens of document-conversion pipelines. Fixed in Ghostscript 9.22 and backported via RHSA-2017:1230, DSA-3838, and equivalent distro advisories.

The vendor scored this 7.8 HIGH with a AV:L (Local) vector, which dramatically understates real-world risk. In practice, Ghostscript is almost never invoked by a human sitting at a terminal — it is called *server-side* by web applications that accept file uploads (image thumbnailing, PDF conversion, résumé parsing). That turns AV:L into effectively AV:N with no authentication. Combined with a CISA KEV listing, a Metasploit module, an EPSS of 96.14%, and the sheer ubiquity of ImageMagick on Linux hosts, the vendor severity is too low. noisgate upgrades this to CRITICAL.

Why this verdict

• AV:L is a misnomer for this deployment pattern. Ghostscript is overwhelmingly consumed as a server-side delegate via ImageMagick/Pillow in web applications. An attacker uploads a crafted .eps to a profile photo endpoint and gets RCE — no local access needed. This alone warrants rescoring the access vector to Network.
• KEV-listed with weaponized tooling. CISA added this to KEV in May 2022 — five years post-disclosure — indicating sustained threat actor interest. A Metasploit module, Vulhub lab, and multiple public PoCs lower the attacker skill bar to near-zero.
• EPSS 96.14% confirms ongoing exploitation signal. This CVE sits in the top 4% of all CVEs for predicted exploitation, meaning threat intelligence feeds and honeypots continue to observe attempts.
• Role multiplier: Ghostscript-via-ImageMagick is deployed on *web application servers*, which are a high-value-role component (line-of-business, often holding session secrets, database credentials, cloud IAM roles). Compromise of the web tier enables lateral movement to databases, internal APIs, and cloud metadata endpoints. On CI/CD hosts that use ImageMagick for artifact processing, this becomes a supply-chain pivot. The blast radius is host → tenant → potentially fleet depending on the compromised service's access. This floors the verdict at HIGH and the remote-equivalent access pushes it to CRITICAL.

Why not higher?

The reassessed score of 9.0 already reflects upgrade to CRITICAL. A 10.0 would require wormable, zero-interaction, network-facing exploitation. This chain still requires the attacker to deliver a file to an upload endpoint and depends on unpatched Ghostscript ≤ 9.21 — a version nearly a decade old. Most maintained environments have patched.

Why not lower?

Despite the vulnerability being nine years old, the KEV listing (added 2022, not 2017) proves threat actors still target it. The Metasploit module makes exploitation trivial. The ImageMagick delegate pattern turns a local binary vuln into unauthenticated remote RCE. Any system still running Ghostscript ≤ 9.21 is almost certainly also missing other critical patches, making it a soft target. The floor from the web-server role multiplier prevents downgrade below HIGH, and the remote-equivalent access vector pushes past that floor to CRITICAL.

1. Disable Ghostscript delegates in ImageMagick policy.xml — Edit /etc/ImageMagick-6/policy.xml (or -7) and add <policy domain="delegate" rights="none" pattern="gs" /> and <policy domain="coder" rights="none" pattern="{PS,PS2,PS3,EPS,PDF,XPS}" />. This kills the attack chain at step 2 without removing Ghostscript. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL.
2. Upgrade Ghostscript to ≥ 9.22 (or apply distro backport) — This is the definitive fix. On RHEL/CentOS: yum update ghostscript. On Debian/Ubuntu: apt-get update && apt-get install ghostscript. The patch has been available since mid-2017. Complete within the noisgate remediation SLA of 90 days.
3. Confine Ghostscript with AppArmor/SELinux/seccomp — If Ghostscript must remain at an older version temporarily, enforce mandatory access control that prevents gs from spawning child processes or writing outside its working directory. Use aa-enforce on Ubuntu or semanage on RHEL.
4. Block PostScript file types at upload ingestion — At the application layer or WAF, reject uploads with PostScript magic bytes (%!PS) or extensions .eps, .ps. This prevents the payload from reaching Ghostscript entirely.

Run this script on each target Linux host where Ghostscript may be installed. Execute as any user: bash check_cve_2017_8291.sh. No elevated privileges required — it checks the installed Ghostscript version and ImageMagick delegate configuration.

#!/usr/bin/env bash
# check_cve_2017_8291.sh — Detect CVE-2017-8291 exposure
# Run on target Linux host. No root required.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

VULNERABLE=0

# Check if Ghostscript is installed
if ! command -v gs &>/dev/null; then
  echo "PATCHED — Ghostscript is not installed on this host."
  exit 0
fi

# Get Ghostscript version
GS_VERSION=$(gs --version 2>/dev/null || echo "unknown")
echo "[*] Ghostscript version detected: $GS_VERSION"

if [[ "$GS_VERSION" == "unknown" ]]; then
  echo "UNKNOWN — Could not determine Ghostscript version."
  exit 2
fi

# Compare version — vulnerable if <= 9.21
# Split version into major.minor
MAJOR=$(echo "$GS_VERSION" | cut -d. -f1)
MINOR=$(echo "$GS_VERSION" | cut -d. -f2)

if [[ "$MAJOR" -lt 9 ]] || { [[ "$MAJOR" -eq 9 ]] && [[ "$MINOR" -le 21 ]]; }; then
  echo "[!] Ghostscript $GS_VERSION is VULNERABLE to CVE-2017-8291 (<=9.21)"
  VULNERABLE=1
else
  echo "[+] Ghostscript $GS_VERSION is PATCHED (>=9.22)"
fi

# Check for distro backport via package version (RPM-based)
if command -v rpm &>/dev/null; then
  PKG=$(rpm -q ghostscript 2>/dev/null || echo "not-installed")
  echo "[*] RPM package: $PKG"
  # RHSA-2017:1230 patched ghostscript-9.07-20.el7_3.5 and later
  if echo "$PKG" | grep -qE 'el[67].*\.(5|[6-9]|[1-9][0-9])\.' 2>/dev/null; then
    echo "[+] Distro backport likely applied — verify with: rpm -q --changelog ghostscript | grep CVE-2017-8291"
  fi
fi

# Check ImageMagick delegate policy
for POLICY in /etc/ImageMagick-{6,7}/policy.xml /usr/local/etc/ImageMagick-{6,7}/policy.xml; do
  if [[ -f "$POLICY" ]]; then
    echo "[*] Checking ImageMagick policy: $POLICY"
    if grep -qi 'pattern="gs".*rights="none"' "$POLICY" 2>/dev/null || \
       grep -qi 'pattern="{.*PS.*}".*rights="none"' "$POLICY" 2>/dev/null || \
       grep -qi 'pattern="PS".*rights="none"' "$POLICY" 2>/dev/null; then
      echo "[+] ImageMagick Ghostscript delegates appear to be disabled."
    else
      echo "[!] ImageMagick Ghostscript delegates are NOT disabled — exploitation via upload is possible."
      if [[ $VULNERABLE -eq 1 ]]; then
        echo "[!!] CRITICAL: Vulnerable Ghostscript + open ImageMagick delegates = remote RCE risk."
      fi
    fi
  fi
done

if [[ $VULNERABLE -eq 1 ]]; then
  echo ""
  echo "VULNERABLE"
  exit 1
else
  echo ""
  echo "PATCHED"
  exit 0
fi

Sources

1. NVD — CVE-2017-8291 Detail
2. Exploit-DB — Ghostscript 9.21 Type Confusion (Metasploit)
3. Rapid7 — Ghostscript CVE-2017-8291
4. GitHub Advisory — GHSA-rh88-cwv2-gjxm
5. Vulhub — PIL CVE-2017-8291 Docker Lab
6. Debian Security Advisory DSA-3838
7. Software Secured — ImageMagick RCE via Ghostscript
8. CISA KEV Catalog