4 ms·
> Ghostscript is..typically included with image conversion and file upload processing toolkits, such as the popular ImageMagick. > The proof-of-concept code..[
by lioeters 5y ago
> Ghostscript is..typically included with image conversion and file upload processing toolkits, such as the popular ImageMagick.
> The proof-of-concept code..[allows] an attacker to upload a malformed SVG file that escapes the image processing pipeline and runs malicious code on the underlying operating system.
Python code demonstrating the exploit: https://github.com/duc-nt/RCE-0-day-for-GhostScript-9.50/blob/main/IM-RCE-via-GhostScript-9.5.py https://github.com/duc-nt/RCE-0-day-for-GhostScript-9.50/blo...