Listen to this Post
When an application opens an untrusted Encapsulated PostScript file and requests Pillow to render it at an increased scale, Pillow relies on Ghostscript to generate an image significantly larger than the configured size limit. The core vulnerability stems from the fact that the size validation check occurs exclusively after Ghostscript has completed rendering and written the full raw image data to a temporary file on disk. An attacker capable of uploading a small malicious file can force the system to spend multiplication-factor resources on Ghostscript rendering work and temporary disk space. Because the scaled product is never validated against decompression bomb thresholds prior to invocation, excessive resource consumption occurs before any defensive limits are triggered.
DailyCVE Form:
Platform: Pillow
Version: < 10.3.0
Vulnerability : Decompression Bomb
Severity: Medium
date: 2024-05-14
Prediction: 2024-05-14
What Undercode Say:
The issue arises because `EpsImageFile.load(scale=N)` calculates scaled dimensions without invoking an intermediate check. The fix requires inserting a validation call immediately after the scaled dimensions are computed in the `Ghostscript()` function, ensuring exceptions are thrown prior to external binary execution.
Exploit: (Educational Purposes!)
import os, tempfile, warnings
from PIL import Image, EpsImagePlugin
EpsImagePlugin.gs_binary = "gs"
path = os.path.join(tempfile.mkdtemp(), "a.eps")
with open(path, "w") as f:
f.write("%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 9000 9000\n%%EndComments\nshowpage\n")
with Image.open(path) as im:
im.load(scale=2)
Protection:
Apply the official patch to `src/PIL/EpsImagePlugin.py` by adding `Image._decompression_bomb_check((width, height))` right after calculating width and height in the `Ghostscript()` function to enforce size limits before execution.
Impact:
Attackers can cause excessive CPU utilization and consume gigabytes of temporary disk space via unconstrained rendering processes when parsing untrusted EPS inputs with scaling multipliers greater than one.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
