CVE-2025-27837

Executive Summary

CVE-2025-27837 is a path traversal vulnerability in Artifex Ghostscript, affecting versions prior to 10.05.0. The flaw allows an attacker to access arbitrary files on the system by exploiting a truncated path containing invalid UTF-8 characters. The vulnerability resides in the base/gp_mswin.c and base/winrtsup.cpp files, which handle file path operations on Windows systems. This can lead to unauthorized file disclosure, potentially exposing sensitive data such as configuration files, credentials, or other critical system resources. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, due to the widespread use of Ghostscript in document processing pipelines, the risk remains significant for unpatched systems.

Supply Chain & Package Security

Ghostscript is a critical component in many software supply chains, often used as a dependency for document conversion, PDF generation, and image processing. Organizations using Ghostscript in their CI/CD pipelines, web applications, or server-side document processing are at risk. The vulnerability can be exploited by crafting a malicious document that, when processed by Ghostscript, triggers the path traversal. This could lead to data exfiltration or further compromise of the supply chain if the attacker gains access to build artifacts or source code.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability type (path traversal) and the potential impact (arbitrary file access), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (AV:N) – The vulnerability can be triggered remotely by sending a crafted document.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required beyond processing the malicious file.
• Privileges Required (PR): None (PR:N) – No authentication is needed.
• User Interaction (UI): Required (UI:R) – A user or automated process must open the malicious file.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Arbitrary file read can expose sensitive data.
• Integrity (I): None (I:N) – No file modification is possible.
• Availability (A): None (A:N) – No denial of service.

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium. While the impact is significant, the lack of public exploits and low EPSS score reduce the immediate threat. However, the vulnerability is easy to exploit once a crafted file is processed.

Deep Dive & Mechanics

The vulnerability lies in how Ghostscript handles file paths on Windows systems. The functions in base/gp_mswin.c and base/winrtsup.cpp are responsible for converting and validating file paths. When a path contains invalid UTF-8 characters, the truncation logic can be bypassed, allowing an attacker to traverse directories.

Root Cause: The path normalization routines do not properly handle malformed UTF-8 sequences. When a path is truncated (e.g., due to length limits), the invalid characters can cause the path to be interpreted differently, potentially escaping the intended directory.

Attack Vector: An attacker crafts a PostScript or PDF file that includes a file access operation (e.g., file operator) with a path containing invalid UTF-8 characters. When Ghostscript processes this file, the path traversal is triggered, allowing the attacker to read arbitrary files.

Example Path: C:\Users\Public\..\..\Windows\System32\config\SAM (with invalid UTF-8 characters inserted to bypass truncation checks).

Vulnerable vs. Patched Code

Vulnerable Code (before 10.05.0):

// base/gp_mswin.c
char* gp_validate_path(const char* path) {
    // No proper UTF-8 validation
    char* normalized = normalize_path(path);
    if (strlen(normalized) > MAX_PATH) {
        // Truncation without checking for invalid characters
        normalized[MAX_PATH] = '\0';
    }
    return normalized;
}

Patched Code (10.05.0 and later):

// base/gp_mswin.c
char* gp_validate_path(const char* path) {
    // Validate UTF-8 encoding first
    if (!is_valid_utf8(path)) {
        return NULL; // Reject invalid paths
    }
    char* normalized = normalize_path(path);
    if (strlen(normalized) > MAX_PATH) {
        // Truncation with proper boundary check
        normalized[MAX_PATH] = '\0';
        // Ensure no partial multi-byte character at truncation point
        while (normalized[MAX_PATH-1] & 0x80) {
            normalized[--MAX_PATH] = '\0';
        }
    }
    return normalized;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Ghostscript version 10.04.0 on a Windows VM.
2. Create a malicious PostScript file (exploit.ps) that attempts to read C:\Windows\System32\drivers\etc\hosts.
3. Use the following PostScript code:

%!PS
(/C:/Windows/System32/drivers/etc/hosts) (r) file
% Note: The path contains invalid UTF-8 characters (e.g., 0x80) to trigger the vulnerability
% Actual exploitation requires crafting the exact invalid sequence

Exploitation Steps:

1. Run Ghostscript with the malicious file: gswin64c.exe exploit.ps
2. If successful, the contents of the hosts file will be displayed or written to output.

Note: No public exploit code is available, so this is a theoretical approach.

Blue Team

Detection:

• Monitor Ghostscript processes for unusual file access patterns, especially to system directories.
• Use file integrity monitoring to detect unauthorized reads of sensitive files.
• Implement application whitelisting to restrict Ghostscript execution.

Hunting:

• Search for Ghostscript command lines that include paths with non-ASCII characters.
• Analyze PostScript/PDF files for suspicious file access operators (e.g., file, run).

Indicators of Compromise (IOCs)

• File Hashes: (None available, but monitor for Ghostscript executables with version < 10.05.0)
• Network Indicators: Ghostscript processes making outbound connections to unknown IPs (if data exfiltration occurs).
• Process Anomalies: Ghostscript (gswin64c.exe, gs.exe) accessing files outside its working directory.
• Registry Keys: (Windows) HKLM\SOFTWARE\Artifex\Ghostscript – version information.
• YARA Rule: (See Detection Engineering)

Detection Engineering

YARA Rule

rule CVE_2025_27837_Ghostscript_Path_Traversal {
    meta:
        description = "Detects Ghostscript files attempting path traversal via invalid UTF-8"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-27837"
    strings:
        $ps_operator = /\([^)]*\)\s*\(r\)\s*file/ nocase
        $invalid_utf8 = { 80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D 8E 8F }
        $path_traversal = /\.\.\\/ nocase
    condition:
        $ps_operator and ($invalid_utf8 or $path_traversal)
}

Sigma Rule

title: Ghostscript Path Traversal via Invalid UTF-8
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Ghostscript processes accessing files with invalid UTF-8 paths
author: Valters IT
date: 2025-03-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27837
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\gswin64c.exe'
            - '\gs.exe'
        CommandLine|contains:
            - '..\\'
            - '\x80'
            - '\x81'
    condition: selection
falsepositives:
    - Legitimate use of Ghostscript with complex paths
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27837 Ghostscript Path Traversal Attempt"; flow:to_server,established; content:"file"; nocase; content:"..\\"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Ghostscript to version 10.05.0 or later.
2. If upgrade is not possible, restrict Ghostscript execution to trusted users and directories.
3. Implement file system access controls to limit what Ghostscript can read.

Long-term Measures:

• Use application sandboxing (e.g., Windows AppLocker, Docker) to isolate Ghostscript.
• Regularly update all dependencies in the software supply chain.
• Monitor for new CVEs and apply patches promptly.

Workarounds:

• Disable file access operators in PostScript if not needed (e.g., using -dSAFER mode).
• Use a dedicated, minimal Ghostscript installation for document processing.

Valters IT
Securing Digital Frontiers