php-font-lib 0.3 - Subset maker (make_subset.php) Reflected Cross-site Scripting
Author: Daniel C. Marques (@0xc0da)
Release date: 2014-03-23
Revision 1.1
Disclosure Timeline
2014-03-19 - Developer notified.
2014-03-19 - Developer patch.
2014-03-20 - CVE-2014-2570 assigned.
2014-03-23 - Public disclosure.
Product Information
Product: php-font-lib
Description: A library to read, parse, export and make subsets of different types of font files.
Developer: Fabien Ménager
Website: https://github.com/PhenX/php-font-lib
Overview
The Subset maker of the affected php-font-lib versions is vulnerable to a Reflected Cross Site Scripting. This vulnerability might allow remote unauthenticated attackers to inject arbitrary Javascript or HTML via the ‘name’ parameter. This flaw exists because the contents of ‘name’ are not sanitized before it is inserted in the web page.
Vulnerability Information
Vulnerability: Reflected Cross-site Scripting
CVE Identifier: CVE-2014-2570
CVSSv2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE Identifier: CWE-79 - Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Affected releases: 0.3
Vulnerability details
The make_subset.php script in the ‘www’ directory does not sanitize the contents of the ‘name’ parameter before echoing it to the user. The vulnerable piece of code is shown below:
<h1><?php echo $name ?></h1>
This vulnerability can be used to inject Javascript code to be rendered by the browser. An attacker must trick the user to access a crafted URL (using social engineering, e.g.) for a successful attack.
Proof-of-Concept
http://www.example.com/php-font-lib/www/make_subset.php?fontfile=../fonts/Norasi.ttf&name=<script>alert('XSS')</script>
Solution
The developer informed that version 0.3.1 fixes the issue.
Credits
Vulnerability identified and reported by Daniel C. Marques (@0xc0da).
References
[1] https://github.com/PhenX/php-font-lib
[2] https://cwe.mitre.org/data/definitions/79.html
[3] http://codalabs.net/cla-2014-001
[4] http://www.securityfocus.com/archive/1/531587/30/0/threaded
[5] http://secunia.com/advisories/57558
