CVE-2023-45139

fontTools subsetting module in version 4.42.0 XML External Entity Injection (XXE) via SVG table in OT-SVG fonts

• CVSS 7.5
• CWE-611 Improper Restriction of XML External Entity Reference
• Input Validation and Sanitization
• Remote

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

CVE

CVE-2023-45139

CWE

CWE-611 Improper Restriction of XML External Entity Reference

CVSS base score

7.5

Published

2024-01-10

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade fontTools to version 4.43.0 or newer

import fontTools.ttLib
from fontTools.ttLib import TTFont
from lxml import etree

def parse_ot_svg_font(font_path):
    font = TTFont(font_path)
    svg_table = font['SVG '].table
    # Assuming svg_table is a string containing XML data
    xml_data = svg_table.toXML()  # This is a placeholder for actual SVG table extraction
    # Vulnerable XML parsing that allows external entities
    xml_tree = etree.fromstring(xml_data.encode('utf-8'))
    # Continue processing with xml_tree...

# Example usage
# parse_ot_svg_font('path/to/font.ot.svg')

import fontTools.ttLib
from fontTools.ttLib import TTFont
from lxml import etree

def safe_parse_xml(xml_data):
    # Disable DTD and external entity processing to prevent XXE
    parser = etree.XMLParser(load_dtd=False, no_network=True)
    return etree.fromstring(xml_data.encode('utf-8'), parser)

def parse_ot_svg_font(font_path):
    font = TTFont(font_path)
    svg_table = font['SVG '].table
    # Assuming svg_table is a string containing XML data
    xml_data = svg_table.toXML()  # This is a placeholder for actual SVG table extraction
    safe_xml = safe_parse_xml(xml_data)
    # Continue processing with safe_xml...

# Example usage
# parse_ot_svg_font('path/to/font.ot.svg')

@misc{vaitp:cve202345139,
  title        = {{fontTools subsetting module in version 4.42.0 XML External Entity Injection (XXE) via SVG table in OT-SVG fonts}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-45139},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-45139/}}
}