Listen to this Post
docx-preview renders DOCX in browser.
It reads word/fontTable.xml.
Embedded font-family names are extracted.
Names are interpolated into injected @font-face style.
The style is added page-wide.
No escaping is applied to quotes.
No escaping is applied to backslash.
No escaping is applied to angle brackets.
No escaping is applied to CSS newlines.
A crafted font name can close style.
It can inject arbitrary CSS.
CSS applies on open.
No user click is required.
Attackers can overlay content.
Attackers can phish credentials.
Attribute selectors can exfiltrate input values.
Tracking beacons can fire.
Opening crafted .docx triggers CSS.
Clicking Print triggers more.
Print window uses document.write().
Same unescaped font name is written.
Name can break out of
">
@font-face { font-family: "x
“; src: url(…); }
document.write(‘
‘);
Exploit: (Educational Purposes!)
Craft DOCX with malicious w:name.
Open in vulnerable docx-preview.
CSS injects on open.
Print triggers script.
“;src:url(x);}
Protection: from this CVE
Upgrade to 0.3.3.
Escape quotes, backslash, < >, CSS newlines.
Use DOM APIs for print window.
Sanitize font-family names.
Impact:
Zero-click CSS injection.
Page-wide overlay/phishing.
Attribute-selector exfiltration.
Tracking beacons.
Print escalation to script execution.
Script runs in embedder origin.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
