Lab 126 — AssetForge — RCE via Ghostscript Pipe Device Bypass (CVE-2023-36664)

hackadvisor

Task: Digital asset management platform (AssetForge) that processes EPS/PS/PDF uploads via Ghostscript for thumbnail generation and format conversion. Solution: Exploited CVE-2023-36664 by uploading a malicious EPS file with PostScript %pipe% operator to execute shell commands; flag rendered as text in the generated thumbnail and extracted via OCR.