CVE-2024-46954: Artifex Ghostscript Path Traversal Flaw

CVE-2024-46954 Overview

CVE-2024-46954 is a directory traversal vulnerability discovered in the decode_utf8 function within base/gp_utf8.c in Artifex Ghostscript before version 10.04.0. The vulnerability occurs due to improper handling of overlong UTF-8 encoding sequences, which allows attackers to craft malicious input that bypasses path sanitization filters and achieves ../ directory traversal. This can enable unauthorized access to files outside the intended directory scope when processing specially crafted documents.

Critical Impact

Attackers can exploit overlong UTF-8 encoding to bypass path validation, potentially reading or writing files outside restricted directories during Ghostscript document processing operations.

Affected Products

• Artifex Ghostscript versions prior to 10.04.0

Discovery Timeline

• 2024-11-10 - CVE-2024-46954 published to NVD
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2024-46954

Vulnerability Analysis

The vulnerability resides in the UTF-8 decoding logic within Ghostscript's base/gp_utf8.c file. UTF-8 encoding uses a variable-length character encoding scheme where characters can be represented in 1-4 bytes. An "overlong" encoding occurs when a character is encoded using more bytes than necessary—for example, encoding the ASCII character / (U+002F) using two or more bytes instead of the required single byte.

The decode_utf8 function failed to properly reject these non-canonical overlong sequences. Attackers can exploit this by encoding path traversal sequences like ../ using overlong UTF-8 representations. Since many path validation routines check for the standard ASCII representation of ../, the overlong-encoded variant slips through the security checks, only to be decoded back to the dangerous sequence during later processing.

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, or 'Path Traversal').

Root Cause

The root cause stems from the decode_utf8 function not implementing strict UTF-8 validation according to RFC 3629. The function accepted overlong encodings as valid input rather than rejecting them as malformed UTF-8 sequences. Proper UTF-8 parsers must enforce that each code point is encoded using the minimum number of bytes required, rejecting any overlong sequences as invalid.

Attack Vector

Exploitation requires local access where a user must open a maliciously crafted document (such as a PostScript or PDF file) with Ghostscript. The malicious document contains file path references encoded with overlong UTF-8 sequences that represent directory traversal patterns. When Ghostscript processes the document and decodes these paths, the traversal sequences allow access to files outside the intended working directory.

The attack scenario involves:

1. Crafting a document with path references using overlong UTF-8 encoding for ../ sequences
2. Convincing a user to process the document with Ghostscript or an application that uses Ghostscript as a backend
3. The overlong encoding bypasses input validation during initial parsing
4. Upon UTF-8 decoding, the path resolves to unauthorized locations, enabling file read or write operations

Detection Methods for CVE-2024-46954

Indicators of Compromise

• Unexpected file access patterns in directories outside Ghostscript's normal working scope
• Processing of documents containing non-canonical UTF-8 sequences in path strings
• Unusual Ghostscript process behavior accessing sensitive system files
• Log entries showing file operations in unexpected directory locations

Detection Strategies

• Monitor Ghostscript processes for file access attempts outside expected directories
• Implement file integrity monitoring on sensitive system files and directories
• Use application-level logging to capture file path operations during document processing
• Deploy endpoint detection solutions that can identify path traversal attack patterns

Monitoring Recommendations

• Enable verbose logging for Ghostscript operations to capture file access attempts
• Configure SentinelOne Singularity Platform to monitor for suspicious file access patterns from Ghostscript processes
• Implement alerts for any file read/write operations in sensitive directories initiated by document processing applications
• Review system audit logs for unusual file access sequences during PostScript or PDF processing

How to Mitigate CVE-2024-46954

Immediate Actions Required

• Upgrade Artifex Ghostscript to version 10.04.0 or later immediately
• Review and restrict file system permissions for Ghostscript process execution
• Implement additional input validation on documents before Ghostscript processing
• Consider sandboxing Ghostscript operations to limit file system access scope

Patch Information

Artifex has addressed this vulnerability in Ghostscript version 10.04.0. The fix involves proper validation of UTF-8 sequences in the decode_utf8 function to reject overlong encodings as malformed input. The specific patch can be reviewed at the Ghostscript Commit #55f587d. Additional details about the issue are available in Ghostscript Bug Report #707788.

Workarounds

• Run Ghostscript in a sandboxed or containerized environment with restricted file system access
• Configure the -dSAFER flag when running Ghostscript to restrict file operations
• Implement strict directory access controls limiting where Ghostscript can read or write files
• Pre-validate documents using additional security tools before Ghostscript processing

# Run Ghostscript with SAFER mode enabled to restrict file operations
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=output.pdf input.ps

# Alternatively, use containerized execution with restricted mount points
docker run --rm -v /safe/input:/input:ro -v /safe/output:/output ghostscript-container gs -dSAFER input.ps